Durch die Internetsicherheitseinstellungen wurde verhindert, dass eine oder mehrere Dateien geöffnet wurden".

fracar · 01.12.2014, 20:36

Nach einem völlig normalen Herunterfahren des Laptops habe ich ihn nach ein paar Stunden wieder eingeschaltet. Sofort fiel auf, dass sich das Hintergrundbild geändert hat (auf Werkseinstellung).
Zusätzlich sind jegliche Icons aus der Taskleiste sowie aus dem Startmenü verschwunden und ich bekomme auch keine mehr da hinein geschoben.

Das Schlimmste: egal, welches Programm ich versuche zu Öffnen (inkl. Virenscanner), es erscheint folgende Fehlermeldung:

"Durch die Internetsicherheitseinstellungen wurde verhindert, dass eine oder mehrere Dateien geöffnet wurden".

Ich bin völlig ratlos, was hier passiert ist. Kann sein, dass es ein Virus ist (den ich natürlich nicht finden kann, da ja kein Programm mehr funktioniert), oder wer weiß was anderes.

Ich hoffe, hier kann man mir helfen.

Ach noch ein Nachtrag. Ich komme natürlich auch nicht ins Internet, denn es lässt sich ja gar kein Programm mehr öffnen.

schrauber · 01.12.2014, 20:58

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

fracar · 01.12.2014, 21:15

hallo und danke für die antwort. aber wie soll ich das machen, wenn ich nicht mehr ins internet komme, weil ich den browser nicht geöffnet bekomme?

thx

ok ich probiers mit dem stick... melde kich dann wieder...

schrauber · 02.12.2014, 17:45

Zitat:

ok ich probiers mit dem stick... melde kich dann wieder...

Zum Beispiel

fracar · 08.12.2014, 14:42

Hallo schrauber,

war die ganze zeit unterwegs und bin erst jetzt dazu gekommen, mal das frst im abgesicherten Modus druchlaufen zu lassen.

die Logdateien habe ich auf meinem Desktop, aber keine Möglichkeit, diese unten zu posten, da das System sie nicht findet. habe die Dateien schon umbenannt und mit ".txt" versehen, aber sie werden bei "Anhäge verwalten" nicht angezeigt.

wie geht's nun weiter?

Danke vielmals !!!

OK

Ich glaub ich habs gefunden und hoffe, das ist ok so ??? DANKE !!!

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 01
Ran by Frank (administrator) on FRANK-LAPTOP on 08-12-2014 14:17:19
Running from C:\Windows\System32\config\systemprofile\Desktop
Loaded Profiles:  (Available profiles: Frank)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Safe Mode (minimal)
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\userinit.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2710856 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-03] (CANON INC.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411952 2014-11-04] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2640408 2014-09-03] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-07-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] ()
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [140640 2009-09-28] (CANON INC.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=
SearchScopes: HKLM -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: AVG Security Toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search)
Winsock: Catalog5 08 C:\Program Files (x86)\Audinate\Shared Files\mdnsNSP.dll [170800] (Audinate Pty. Ltd.)
Winsock: Catalog5-x64 08 C:\Program Files\Audinate\Shared Files\mdnsNSP.dll [179712] (Audinate Pty. Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2013-01-05] () [File not signed]
S2 AuviTranESoundService; C:\Program Files (x86)\AuviTran\AVS-Monitor\AVS-Service.exe [541032 2012-12-10] (AuviTran SARL)
S2 avgfws; C:\Program Files (x86)\AVG\AVG2013\avgfws.exe [1432592 2014-11-04] (AVG Technologies CZ, s.r.o.)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4942384 2014-10-17] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-11-20] (AVG Technologies CZ, s.r.o.)
S2 conmon; C:\Program Files (x86)\Audinate\Shared Files\conmon_cmm_service.exe [309064 2014-05-13] (Audinate Pty. Ltd.)
S2 DanteDiscovery; C:\Program Files (x86)\Audinate\Shared Files\mDNSResponder.exe [426800 2014-05-13] (Audinate Pty. Ltd.)
S2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-11] (AVG Secure Search)
S4 Ksidowsraw; No ImagePath

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [50296 2012-09-04] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.)
S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [209720 2014-11-04] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-10-23] (AVG Technologies CZ, s.r.o.)
S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2014-10-17] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-11] (AVG Technologies)
S2 ESDriver; C:\Windows\System32\DRIVERS\ESDriver.sys [69120 2009-07-06] (Digigram)
R3 O2MDRDR; C:\Windows\System32\DRIVERS\o2mdx64.sys [64160 2009-07-13] (O2Micro )
S1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [90928 2012-03-01] (Windows (R) 2000 DDK provider)
S1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [632752 2012-03-01] (Paragon)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [53760 2012-09-28] (Apple, Inc.) [File not signed]
S3 ysusb64; C:\Windows\System32\drivers\ysusb64.sys [113960 2013-01-29] (Yamaha Corporation)
S3 athr; system32\DRIVERS\athrx.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-08 14:17 - 2014-12-08 14:17 - 00000000 ____D () C:\FRST
2014-12-01 22:00 - 2014-12-01 22:00 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\Apple Computer
2014-12-01 22:00 - 2014-12-01 22:00 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Apple Computer
2014-12-01 22:00 - 2014-12-01 22:00 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-12-01 21:52 - 2014-12-01 21:52 - 00000000 ____D () C:\Windows\system32\%LocalAppData%
2014-12-01 20:07 - 2014-12-01 20:07 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\MFAData
2014-12-01 16:07 - 2014-12-01 16:07 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Apple
2014-12-01 15:23 - 2014-12-01 21:54 - 00000000 ____D () C:\Windows\SysWOW64\cache
2014-12-01 15:23 - 2014-12-01 17:22 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Avg2013
2014-12-01 15:23 - 2014-12-01 16:34 - 00000000 ___RD () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-12-01 15:23 - 2014-12-01 16:34 - 00000000 ___RD () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-01 15:23 - 2014-12-01 16:34 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\AVG2013
2014-12-01 15:23 - 2013-03-21 14:48 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Microsoft Help
2014-12-01 15:23 - 2012-12-31 11:55 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\TuneUp Software
2014-11-27 19:46 - 2014-11-27 19:46 - 00274432 _____ () C:\Windows\Minidump\112714-23462-01.dmp
2014-11-19 21:55 - 2014-12-01 16:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-11-19 21:27 - 2014-11-19 21:27 - 00000000 __SHD () C:\Users\Frank\AppData\Local\EmieBrowserModeList
2014-11-18 20:39 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-18 20:39 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-18 20:39 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-18 20:39 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-18 20:39 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-18 20:39 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-18 20:39 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-18 20:39 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-18 20:39 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-18 20:39 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-18 20:39 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-18 20:39 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-18 20:39 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-18 20:39 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-18 20:39 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-18 20:39 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-18 20:39 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-18 20:39 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-18 20:39 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-18 20:39 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-18 20:39 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-18 20:39 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-18 20:39 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-18 20:39 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-18 20:39 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-11-18 20:39 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-18 20:39 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-18 20:39 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-18 20:39 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-18 20:39 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-18 20:39 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-11-18 20:39 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-18 20:39 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-18 20:39 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-18 20:39 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-18 20:39 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-18 20:39 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-18 20:39 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-18 20:39 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-18 20:39 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-18 20:39 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-18 20:39 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-18 20:39 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-18 20:39 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-18 20:39 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-18 20:39 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-18 20:39 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-18 20:39 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-18 20:39 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-11-18 20:39 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-18 20:39 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-18 20:39 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-18 20:39 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-18 20:39 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-18 20:39 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-18 20:39 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-18 20:39 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-18 20:39 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-18 20:39 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-18 20:39 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-18 20:39 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-18 20:39 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-18 20:39 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-18 20:39 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-18 20:38 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-18 20:38 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-18 20:38 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-18 20:38 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-18 20:38 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-18 20:38 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-18 20:38 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-18 20:38 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-18 20:38 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-18 20:38 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-18 20:38 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-18 20:38 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-18 20:38 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-11-18 20:38 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-11-18 20:38 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-18 20:38 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-18 20:38 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-11-18 20:38 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-11-18 20:38 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-11-18 20:38 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-18 20:38 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-18 20:38 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-18 20:38 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-11-18 20:38 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-18 20:38 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-08 14:16 - 2012-12-31 14:39 - 01132655 _____ () C:\Windows\WindowsUpdate.log
2014-12-08 14:16 - 2009-07-14 05:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-08 14:16 - 2009-07-14 05:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-08 14:14 - 2011-04-12 08:43 - 00703214 _____ () C:\Windows\system32\perfh007.dat
2014-12-08 14:14 - 2011-04-12 08:43 - 00150822 _____ () C:\Windows\system32\perfc007.dat
2014-12-08 14:14 - 2009-07-14 06:13 - 01629372 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-08 14:13 - 2014-02-27 09:25 - 00016194 _____ () C:\Windows\setupact.log
2014-12-08 14:13 - 2013-01-06 14:12 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-08 14:13 - 2013-01-05 13:20 - 00000440 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-08 14:13 - 2012-12-31 13:34 - 00000266 _____ () C:\Windows\Tasks\AutoKMS.job
2014-12-08 14:13 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-01 21:57 - 2012-12-31 12:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-01 21:46 - 2012-12-31 11:51 - 00000000 ____D () C:\ProgramData\MFAData
2014-12-01 21:44 - 2013-01-06 14:12 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-01 16:35 - 2012-12-31 13:34 - 00002896 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-12-01 16:34 - 2014-05-08 09:04 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2014-12-01 16:34 - 2014-05-07 17:11 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-01 16:34 - 2012-12-31 13:34 - 00000000 ____D () C:\Windows\AutoKMS
2014-12-01 16:34 - 2012-12-31 13:18 - 00000000 ____D () C:\Users\Frank\AppData\Roaming\Wise Registry Cleaner
2014-12-01 16:34 - 2012-12-31 12:49 - 00000000 ____D () C:\Windows\system32\Macromed
2014-12-01 16:34 - 2012-12-31 12:40 - 00000000 ____D () C:\Windows\Minidump
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\servicing
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\schemas
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-12-01 15:26 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-12-01 15:23 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-11-19 19:45 - 2014-02-27 09:26 - 00119032 _____ () C:\Users\Frank\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-19 19:44 - 2014-02-27 09:25 - 00444952 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-19 19:43 - 2014-02-27 09:25 - 00003838 _____ () C:\Windows\PFRO.log
2014-11-19 01:03 - 2012-12-31 13:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-11-19 01:01 - 2013-09-12 15:08 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-19 00:59 - 2012-10-11 00:16 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-19 00:14 - 2013-01-02 13:45 - 00000000 ____D () C:\Users\Frank\Documents\Outlook-Dateien
2014-11-18 15:57 - 2012-12-31 12:49 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-18 15:57 - 2012-12-31 12:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-18 15:57 - 2012-12-31 12:49 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-18 15:39 - 2013-03-06 14:45 - 00016500 ____H () C:\Users\Frank\Desktop\~WRL0290.tmp
2014-11-18 15:39 - 2013-01-06 14:12 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-18 15:39 - 2013-01-06 14:12 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-18 15:26 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

Some content of TEMP:
====================
C:\Users\Frank\AppData\Local\Temp\nsn80C7.exe
C:\Users\Frank\AppData\Local\Temp\nsvB8C9.exe
C:\Users\Frank\AppData\Local\Temp\nsxB743.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-27 21:21

==================== End Of Log ============================

--- --- ---

--- --- ---

[/CODE]

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2014 01
Ran by Frank at 2014-12-08 14:17:53
Running from C:\Windows\System32\config\systemprofile\Desktop
Boot Mode: Safe Mode (minimal)
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG Internet Security 2013 (Enabled - Out of date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security 2013 (Enabled - Out of date) {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: AVG Internet Security 2013 (Disabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Photoshop CS (HKLM-x32\...\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}) (Version: CS - Adobe Systems, Inc.)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{914F7627-B645-9895-F723-BAEAAC865E75}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArrayCalc (HKLM-x32\...\{12A03609-5AED-42F5-853C-79A5309E80D6}) (Version: 6.7.15 - d&b audiotechnik GmbH)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
AuviTran AVS-Monitor (HKLM-x32\...\AuviTran AVS-Monitor) (Version:  - )
Auvitran Firmware Updater (HKLM-x32\...\Auvitran Firmware Updater) (Version:  - )
AVG 2013 (HKLM\...\AVG) (Version: 2013.0.3495 - AVG Technologies)
AVG 2013 (Version: 13.0.3495 - AVG Technologies) Hidden
AVG 2013 (Version: 13.0.4189 - AVG Technologies) Hidden
AVG Security Toolbar (HKLM-x32\...\AVG Secure Search) (Version: 18.1.9.799 - AVG Technologies)
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v8.00.12(T) - TOSHIBA CORPORATION)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother P-touch Editor 4.2 (HKLM-x32\...\InstallShield_{003447F5-0058-4B77-9C1E-50488F77C4A7}) (Version: 4.2 - Brother Industries, Ltd.)
Brother P-touch Editor 4.2 (x32 Version: 4.2 - Brother Industries, Ltd.) Hidden
Brother P-touch Editor 5.0 (HKLM-x32\...\{DF9A6075-9308-4572-8932-A4316243C4D9}) (Version: 5.0.2300 - Brother Industries, Ltd.)
Brother P-touch Update Software (HKLM-x32\...\{A598BEC3-4F02-413E-9649-C5A1879DB558}) (Version: 1.0.0010 - Brother Industries, Ltd.)
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon Kurzwahlprogramm (HKLM-x32\...\Speed Dial Utility) (Version:  - )
Canon MP Navigator EX 3.1 (HKLM-x32\...\MP Navigator EX 3.1) (Version:  - )
Canon MX870 series Benutzerregistrierung (HKLM-x32\...\Canon MX870 series Benutzerregistrierung) (Version:  - )
Canon MX870 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX870_series) (Version:  - )
Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )
Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version:  - )
CAPS (HKLM-x32\...\{7FEA5EEA-91C7-4387-9585-682A98DE5EB3}) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 3.26 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.0.3717 - CDBurnerXP)
CrystalDiskInfo 5.1.0 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 5.1.0 - Crystal Dew World)
Dante Control and Monitoring (HKLM-x32\...\{32B9C78C-6BA0-456F-8053-5BA6305AEA37}) (Version: 1.7.8.2 - Audinate Pty. Ltd.)
Dante Controller (HKLM-x32\...\{de711cd0-3404-49b5-8d8b-251ceaf5ae35}) (Version: 3.5.3.1 - Audinate Pty. Ltd.)
Dante Controller (x32 Version: 3.5.3.1 - Audinate) Hidden
Dante Discovery (HKLM\...\{BB809BBB-7F71-402D-B0C0-603008B0BB59}) (Version: 1.0.5.1 - Audinate Pty. Ltd.)
Dante Firmware Update Manager (HKLM-x32\...\{60b610c7-22c6-4005-b252-181b2126425e}) (Version: 1.4.7.1 - Audinate Pty. Ltd.)
Dante Firmware Update Manager Core (x32 Version: 1.4.7.1 - Audinate Pty. Ltd.) Hidden
dsdminst (x32 Version: 1.01.0002 - Brother Industries, Ltd.) Hidden
EASE Focus 2 (HKLM-x32\...\InstallShield_{C5A2F0B5-6725-49A5-9E8E-A5FD86C07423}) (Version: 2.0.11 - AFMG)
EASE Focus 2 (x32 Version: 2.0.11 - AFMG) Hidden
EtherSound Runtime x64 v3.12 d (HKLM\...\{0751579A-00BC-425C-A9D9-E6C81A2C54CC}) (Version: 3.12.3 - EtherSound)
FirSoft build 908 - Firnet Controller Software (HKLM-x32\...\{D7820CF7-5420-42AA-B006-768911C8E001}_is1) (Version:  - HKaudio)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)
LG-FCB ControlCenter 1.1 (HKLM-x32\...\LG-FCB ControlCenter) (Version: 1.1 - GORDIUS)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
O2Micro Flash Memory Card Reader Driver (HKLM\...\{729F014A-9E91-49A6-B5F2-E8AA941452AE}) (Version: 3.31.03.A - O2Micro)
Open It! (HKLM-x32\...\OpenIt Open It!) (Version: 1.1.1 - OpenIt)
Paragon Festplatten Manager™ 12 Professional (HKLM-x32\...\{1E104AF0-EA49-11DE-AC07-005056C00008}) (Version: 90.00.0003 - Paragon Software)
PDF24 Creator 5.2.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PodWare (HKLM-x32\...\{2D9894BE-4FDD-4F2C-9A41-3B683CB90736}) (Version: 5.46.0 - Linea Research)
P-touch Editor 3.2 (HKLM-x32\...\P-touch Editor ver 3.2) (Version:  - )
QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
Soundcraft Virtual Vi 4.7.0 (HKLM-x32\...\SoundcraftVirtualVi) (Version: 4.7.0 - Soundcraft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN)
VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wise Registry Cleaner 7.61 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version:  - WiseCleaner.com, Inc.)
Yamaha Steinberg USB Driver (HKLM-x32\...\InstallShield_{E976141F-5B03-429D-84C2-392E6BB1A45A}) (Version: 1.7.3 - Yamaha Corporation)
Yamaha Steinberg USB Driver (Version: 1.7.3 - Yamaha Corporation) Hidden
YAMAHA THR Editor (HKLM-x32\...\{5115B75F-32BF-42CB-A8BC-2F0A71C4DF93}) (Version: 1.0.0 - Yamaha Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

18-11-2014 23:58:01 Windows Update
27-11-2014 20:28:32 Geplanter Prüfpunkt
01-12-2014 14:29:34 Wiederherstellungsvorgang

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1A6BEF00-52C9-4BA6-9F71-CACE2C4A529E} - System32\Tasks\Digital Sites => C:\Users\Frank\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {1CA4762D-C498-470B-B41F-A6ED504F4C91} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-06] (Google Inc.)
Task: {41F32A97-0CC6-4647-A133-A35662D4A7B0} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2012-12-25] (WiseCleaner.com)
Task: {76701015-8E62-4CD8-A2D9-6D3484490910} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-06] (Google Inc.)
Task: {B1C44252-1BD1-4366-85BF-EF82418846E0} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {C1E86DA9-8445-4C1F-BF86-7CFD03D79E02} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {CCD56122-80F8-4F3D-BA52-5CF47A6C7235} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {E10BF578-A8DE-46D8-8BA2-C3849292AA99} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe
Task: {E391B2C1-86FD-4E6A-AAD9-EE90B988B698} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-12-19] (Piriform Ltd)
Task: {F1152E3B-7622-4801-81CF-6160718DE352} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-18] (Adobe Systems Incorporated)
Task: {F50D10E3-8870-4783-9998-8C1F4E85973F} - System32\Tasks\4679 => Wscript.exe C:\Users\Frank\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AutoKMS.job => C:\Windows\AutoKMS\AutoKMS.exe
Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\Frank\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Wise Registry Cleaner Schedule Task.job => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-3697939779-1139795273-3143350014-500 - Administrator - Enabled)
Frank (S-1-5-21-3697939779-1139795273-3143350014-1000 - Administrator - Enabled) => C:\Users\TEMP.FRANK-LAPTOP
Gast (S-1-5-21-3697939779-1139795273-3143350014-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3697939779-1139795273-3143350014-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/08/2014 02:16:55 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (12/08/2014 02:14:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 02:13:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (12/08/2014 02:13:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (12/08/2014 02:13:06 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (12/08/2014 02:13:06 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (12/08/2014 02:13:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   20 1.0.0.127.in-addr.arpa. PTR Frank-Laptop.local.

Error: (12/08/2014 02:13:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 127.0.0.1:5353   22 1.0.0.127.in-addr.arpa. PTR Frank-Laptop-2.local.

Error: (12/08/2014 02:04:39 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   20 1.0.0.127.in-addr.arpa. PTR Frank-Laptop.local.

Error: (12/08/2014 02:04:39 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 127.0.0.1:5353   22 1.0.0.127.in-addr.arpa. PTR Frank-Laptop-2.local.


System errors:
=============
Error: (12/08/2014 02:17:03 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/08/2014 02:17:03 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/08/2014 02:17:03 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/08/2014 02:17:03 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/08/2014 02:17:03 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/08/2014 02:17:03 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/08/2014 02:17:01 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/08/2014 02:17:01 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/08/2014 02:17:02 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (12/08/2014 02:17:01 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1068netprofm{A47979D2-C419-11D9-A5B4-001185AD2B89}


Microsoft Office Sessions:
=========================
Error: (12/08/2014 02:16:55 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Zugriff verweigert

Error: (12/08/2014 02:14:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 02:13:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Zugriff verweigert

Error: (12/08/2014 02:13:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Zugriff verweigert

Error: (12/08/2014 02:13:06 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Zugriff verweigert

Error: (12/08/2014 02:13:06 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Zugriff verweigert

Error: (12/08/2014 02:13:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   20 1.0.0.127.in-addr.arpa. PTR Frank-Laptop.local.

Error: (12/08/2014 02:13:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 127.0.0.1:5353   22 1.0.0.127.in-addr.arpa. PTR Frank-Laptop-2.local.

Error: (12/08/2014 02:04:39 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   20 1.0.0.127.in-addr.arpa. PTR Frank-Laptop.local.

Error: (12/08/2014 02:04:39 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 127.0.0.1:5353   22 1.0.0.127.in-addr.arpa. PTR Frank-Laptop-2.local.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T8100 @ 2.10GHz
Percentage of memory in use: 13%
Total physical RAM: 4094.43 MB
Available physical RAM: 3559.81 MB
Total Pagefile: 8187.04 MB
Available Pagefile: 7672.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (F1 - SSD Win7) (Fixed) (Total:111.79 GB) (Free:1.31 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (F2 - Hitachi) (Fixed) (Total:232.89 GB) (Free:162.45 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 111.8 GB) (Disk ID: B2FC597E)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 2D5D03CE)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 09.12.2014, 11:30

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

fracar · 11.12.2014, 18:12

Hallo Schrauber,

anbei nun das Textfile von Combofix. Ich hoffe, Du kannst was damit anfangen...

Vielen Dank im Voraus !!!

Code:

ATTFilter

ComboFix 14-12-10.03 - SYSTEM 11.12.2014  17:59:44.1.2 - x64 MINIMAL
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.4094.3528 [GMT 1:00]
ausgeführt von:: F:\ComboFix.exe
AV: AVG Internet Security 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
FW: AVG Internet Security 2013 *Disabled* {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}
SP: AVG Internet Security 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt


((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))


C:\Windows\IsUn0407.exe
C:\Windows\SysWow64\Cache
C:\Windows\SysWow64\Cache\26c630d098e22dd5.fb
C:\Windows\SysWow64\Cache\272512937d9e61a4.fb
C:\Windows\SysWow64\Cache\272512937d9e61a4__exp__1418135222
C:\Windows\SysWow64\Cache\287204568329e189.fb
C:\Windows\SysWow64\Cache\28bc8f716fd76a47.fb
C:\Windows\SysWow64\Cache\28bc8f716fd76a47__exp__1418135222
C:\Windows\SysWow64\Cache\31a0997e9a5b5eb3.fb
C:\Windows\SysWow64\Cache\32c84fe32bb74d60.fb
C:\Windows\SysWow64\Cache\32c84fe32bb74d60__exp__1418135223
C:\Windows\SysWow64\Cache\3917078cb68ec657.fb
C:\Windows\SysWow64\Cache\590ba23ce359fd0c.fb
C:\Windows\SysWow64\Cache\590ba23ce359fd0c__exp__1418135223
C:\Windows\SysWow64\Cache\610289e025a3ee9a.fb
C:\Windows\SysWow64\Cache\651c5d3cdbfb8bd1.fb
C:\Windows\SysWow64\Cache\651c5d3cdbfb8bd1__exp__1418135222
C:\Windows\SysWow64\Cache\67aba075a8729145.fb
C:\Windows\SysWow64\Cache\67aba075a8729145__exp__1418135222
C:\Windows\SysWow64\Cache\6c59ac5e7e7a3ad0.fb
C:\Windows\SysWow64\Cache\6c59ac5e7e7a3ad0__exp__1418135222
C:\Windows\SysWow64\Cache\6d03dad1035885d3.fb
C:\Windows\SysWow64\Cache\6d03dad1035885d3__exp__1418135223
C:\Windows\SysWow64\Cache\95f567698be8a182.fb
C:\Windows\SysWow64\Cache\ad10a52aff5e038d.fb
C:\Windows\SysWow64\Cache\ad10a52aff5e038d__exp__1418135222
C:\Windows\SysWow64\Cache\c1fa887b03019701.fb
C:\Windows\SysWow64\Cache\c1fa887b03019701__exp__1418135223
C:\Windows\SysWow64\Cache\c4d28dca2e7648be.fb
C:\Windows\SysWow64\Cache\c4d28dca2e7648be__exp__1418135222
C:\Windows\SysWow64\Cache\d201ef9910cd39de.fb
C:\Windows\SysWow64\Cache\d201ef9910cd39de__exp__1418135222
C:\Windows\SysWow64\Cache\d2e94710a5708128.fb
C:\Windows\SysWow64\Cache\d79b9dfe81484ec4.fb
C:\Windows\SysWow64\Cache\f998975c9cc711ee.fb
C:\Windows\SysWow64\Cache\f998975c9cc711ee__exp__1418135223


(((((((((((((((((((((((   Dateien erstellt von 2014-11-11 bis 2014-12-11  ))))))))))))))))))))))))))))))


2014-12-08 14:26:59 . 2014-12-08 14:26:59	--------	d-sh--w-	C:\Users\Default\AppData\Local\EmieUserList
2014-12-08 14:26:59 . 2014-12-08 14:26:59	--------	d-sh--w-	C:\Users\Default\AppData\Local\EmieSiteList
2014-12-08 14:26:59 . 2014-12-08 14:26:59	--------	d-sh--w-	C:\Users\Default\AppData\Local\EmieBrowserModeList
2014-12-08 13:17:11 . 2014-12-08 13:17:56	--------	d-----w-	C:\FRST
2014-12-01 21:00:29 . 2014-12-01 21:00:37	--------	d-----w-	C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-12-01 20:52:27 . 2014-12-01 20:52:27	--------	d-----w-	C:\Windows\system32\%LocalAppData%
2014-12-01 20:51:40 . 2014-12-08 13:21:11	--------	d-sh--w-	C:\Windows\system32\config\systemprofile\AppData\Local\EmieSiteList
2014-12-01 20:51:40 . 2014-12-01 20:51:40	--------	d-sh--w-	C:\Windows\system32\config\systemprofile\AppData\Local\EmieUserList
2014-12-01 20:51:40 . 2014-12-01 20:51:40	--------	d-sh--w-	C:\Windows\system32\config\systemprofile\AppData\Local\EmieBrowserModeList
2014-12-01 14:26:28 . 2014-12-11 17:03:15	--------	d-----w-	C:\Windows\system32\config\systemprofile\AppData\Local\Temp
2014-12-01 14:23:41 . 2014-12-01 14:23:41	--------	d-----w-	C:\Windows\system32\config\systemprofile\AppData\Local\Toshiba
2014-12-01 14:23:38 . 2014-12-01 14:23:38	--------	d-----w-	C:\Windows\system32\config\systemprofile\AppData\Roaming\ATI
2014-12-01 14:23:38 . 2014-12-01 14:23:38	--------	d-----w-	C:\Windows\system32\config\systemprofile\AppData\Local\ATI
2014-12-01 14:23:11 . 2014-12-01 14:23:25	--------	d-----w-	C:\Users\TEMP.FRANK-LAPTOP
2014-11-19 20:27:05 . 2014-11-19 20:27:05	--------	d-sh--w-	C:\Users\Frank\AppData\Local\EmieBrowserModeList
2014-11-18 19:38:32 . 2014-08-21 06:43:26	1882624	----a-w-	C:\Windows\system32\msxml3.dll
.


((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

2014-12-08 13:43:09 . 2014-05-07 13:37:03	163504	----a-w-	C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2014-11-18 23:59:11 . 2012-10-10 23:16:21	103374192	----a-w-	C:\Windows\system32\MRT.exe
2014-11-18 14:57:17 . 2012-12-31 11:49:52	71344	----a-w-	C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-11-18 14:57:17 . 2012-12-31 11:49:52	701104	----a-w-	C:\Windows\SysWow64\FlashPlayerApp.exe
2014-11-03 23:30:04 . 2014-11-03 23:30:04	209720	----a-w-	C:\Windows\system32\drivers\avgldx64.sys
2014-10-17 14:34:46 . 2014-10-17 14:34:46	240952	----a-w-	C:\Windows\system32\drivers\avgtdia.sys
2014-09-25 02:08:38 . 2014-10-19 00:18:07	371712	----a-w-	C:\Windows\system32\qdvd.dll
2014-09-25 01:40:50 . 2014-10-19 00:18:07	519680	----a-w-	C:\Windows\SysWow64\qdvd.dll


((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))


*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2014-09-03 18:43:42	3627032	----a-w-	C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll" [2014-09-03 18:43:42 3627032]

[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"AVG_UI"="C:\Program Files (x86)\AVG\AVG2013\avgui.exe" [2014-11-03 23:31:08 4411952]
"vProt"="C:\Program Files (x86)\AVG Secure Search\vprot.exe" [2014-09-03 18:43:42 2640408]
"StartCCC"="C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-07-04 02:03:04 641704]
"VirtualCloneDrive"="C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 13:33:08 89456]
"IJNetworkScanUtility"="C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-09-28 16:56:18 140640]
"PDFPrint"="C:\Program Files (x86)\PDF24\pdf24.exe" [2012-12-12 09:28:14 163000]
"APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-07-31 10:15:54 43816]
"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 16:30:32 959176]
"QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe" [2012-10-25 02:12:14 421888]
"iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe" [2014-08-01 14:18:32 152392]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2013-1-5 113664]
Bluetooth Manager.lnk - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2011-5-9 2750376]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)

R1 Avgfwfd;AVG network filter service;C:\Windows\system32\DRIVERS\avgfwd6a.sys;C:\Windows\SYSNATIVE\DRIVERS\avgfwd6a.sys [x]
R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\system32\DRIVERS\avgidsdrivera.sys;C:\Windows\SYSNATIVE\DRIVERS\avgidsdrivera.sys [x]
R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\system32\DRIVERS\avgldx64.sys;C:\Windows\SYSNATIVE\DRIVERS\avgldx64.sys [x]
R1 Avgtdia;AVG TDI Driver;C:\Windows\system32\DRIVERS\avgtdia.sys;C:\Windows\SYSNATIVE\DRIVERS\avgtdia.sys [x]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe;C:\Windows\SYSNATIVE\atiesrxx.exe [x]
R2 AuviTranESoundService;AuviTran EtherSound Service;C:\Program Files (x86)\AuviTran\AVS-Monitor\AVS-Service.exe;C:\Program Files (x86)\AuviTran\AVS-Monitor\AVS-Service.exe [x]
R2 avgfws;AVG Firewall;C:\Program Files (x86)\AVG\AVG2013\avgfws.exe;C:\Program Files (x86)\AVG\AVG2013\avgfws.exe [x]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [x]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 conmon;Dante Control and Monitoring;C:\Program Files (x86)\Audinate\Shared Files\conmon_cmm_service.exe;C:\Program Files (x86)\Audinate\Shared Files\conmon_cmm_service.exe [x]
R2 DanteDiscovery;Dante Discovery;C:\Program Files (x86)\Audinate\Shared Files\mDNSResponder.exe;C:\Program Files (x86)\Audinate\Shared Files\mDNSResponder.exe [x]
R2 ESDriver;EtherSound Protocol;C:\Windows\system32\DRIVERS\ESDriver.sys;C:\Windows\SYSNATIVE\DRIVERS\ESDriver.sys [x]
R2 vToolbarUpdater18.1.9;vToolbarUpdater18.1.9;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys;C:\Windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys;C:\Windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\system32\IEEtwCollector.exe;C:\Windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys;C:\Windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys;C:\Windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS;C:\Windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS;C:\Windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS;C:\Windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;C:\Windows\system32\drivers\Synth3dVsc.sys;C:\Windows\SYSNATIVE\drivers\Synth3dVsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys;C:\Windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys;C:\Windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;C:\Windows\system32\drivers\TsUsbGD.sys;C:\Windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;Remote Deskotop USB Hub;C:\Windows\system32\drivers\tsusbhub.sys;C:\Windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys;C:\Windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VGPU;VGPU;C:\Windows\system32\drivers\rdvgkmd.sys;C:\Windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 ysusb64;Yamaha Steinberg USB Audio;C:\Windows\system32\drivers\ysusb64.sys;C:\Windows\SYSNATIVE\drivers\ysusb64.sys [x]
R3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;C:\Windows\system32\DRIVERS\yk62x64.sys;C:\Windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
R4 Ksidowsraw;Ksidowsraw; [x]
S0 AVGIDSHA;AVGIDSHA;C:\Windows\system32\DRIVERS\avgidsha.sys;C:\Windows\SYSNATIVE\DRIVERS\avgidsha.sys [x]
S0 Avgloga;AVG Logging Driver;C:\Windows\system32\DRIVERS\avgloga.sys;C:\Windows\SYSNATIVE\DRIVERS\avgloga.sys [x]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\system32\DRIVERS\avgmfx64.sys;C:\Windows\SYSNATIVE\DRIVERS\avgmfx64.sys [x]
S0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\system32\DRIVERS\avgrkx64.sys;C:\Windows\SYSNATIVE\DRIVERS\avgrkx64.sys [x]
S1 avgtp;avgtp;C:\Windows\system32\drivers\avgtpx64.sys;C:\Windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S3 O2MDRDR;O2MDRDR;C:\Windows\system32\DRIVERS\o2mdx64.sys;C:\Windows\SYSNATIVE\DRIVERS\o2mdx64.sys [x]


Inhalt des "geplante Tasks" Ordners

2014-12-09 C:\Windows\Tasks\Adobe Flash Player Updater.job
- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-31 11:49:52 . 2014-11-18 14:57:17]

2014-12-11 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-06 13:12:47 . 2013-01-06 13:12:45]

2014-12-08 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-06 13:12:47 . 2013-01-06 13:12:45]

2014-10-19 C:\Windows\Tasks\Wise Registry Cleaner Schedule Task.job
- C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2012-12-31 12:14:04 . 2012-12-25 11:19:42]


--------- X64 Entries -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="C:\Program Files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 14:27:52 108144]
"CanonMyPrinter"="C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" [2009-11-01 17:30:00 2710856]
"CanonSolutionMenu"="C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2009-09-03 16:43:00 767312]

------- Zusätzlicher Suchlauf -------

mStart Page = hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=
mLocal Page = C:\Windows\SysWOW64\blank.htm
IE: An OneNote s&enden - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll

- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-P-touch Editor ver 3.2 - C:\Windows\IsUn0407.exe

schrauber · 12.12.2014, 17:07

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

fracar · 12.12.2014, 19:36

Hallo Schrauber,

Habe alles wie in der Beschreibung durchgeführt.

Jedenfalls hab ich jetzt meinen PC neu gestartet und der Desktop-Hintergrund war weg und alle Icons durcheinandergewürfelt. Allerdings habe ich wieder Zugriff auf die Programme und nach dem Anmelden erscheint auch nicht mehr "Desktop wird vorbereitet"

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 12.12.2014
Suchlauf-Zeit: 17:44:25
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2014.11.20.06
Rootkit Datenbank: v2014.11.18.01
Lizenz: Testversion
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Frank

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 406961
Verstrichene Zeit: 7 Min, 10 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 13
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}, In Quarantäne, [0afc7dc157254cea7189767e1ce632ce], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, In Quarantäne, [0afc7dc157254cea7189767e1ce632ce], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{C292AD0A-C11F-479B-B8DB-743E72D283B0}, In Quarantäne, [0afc7dc157254cea7189767e1ce632ce], 
PUP.Optional.SearchProtect.A, HKU\S-1-5-21-3697939779-1139795273-3143350014-1000.bak-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, In Quarantäne, [9571eb53d5a715218b25ffbcb34f13ed], 
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, In Quarantäne, [9571eb53d5a715218b25ffbcb34f13ed], 
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, In Quarantäne, [38ce71cd136976c0a50c6e4d8a7812ee], 
PUP.Optional.SweetIM.A, HKLM\SOFTWARE\WOW6432NODE\SWEETIM, In Quarantäne, [73938faf4537290da080444944c0eb15], 
PUP.Optional.SystemSpeedup, HKLM\SOFTWARE\WOW6432NODE\SYSTWEAK\ssd, In Quarantäne, [9a6cbb8394e8d165ab459db3ef1404fc], 
PUP.Optional.DigitalSites.A, HKU\S-1-5-21-3697939779-1139795273-3143350014-1000.bak-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DSiteproducts, In Quarantäne, [1fe743fbd2aaf541af792f867f855ba5], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-3697939779-1139795273-3143350014-1000.bak-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [877fd569f3893df914ee44323ec5d927], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-3697939779-1139795273-3143350014-1000.BAK-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [dd2950ee423a45f1f740b8d446beda26], 
PUP.Optional.SweetIM.A, HKU\S-1-5-21-3697939779-1139795273-3143350014-1000.BAK-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SWEETIM, In Quarantäne, [62a446f8d8a40630ab74c7c6df2555ab], 
PUP.Optional.SystemSpeedup, HKU\S-1-5-21-3697939779-1139795273-3143350014-1000.bak-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SYSTWEAK\ssd, In Quarantäne, [31d593abb1cb54e29758a1af758ee917], 

Registrierungswerte: 3
PUP.Optional.SweetIM.A, HKLM\SOFTWARE\WOW6432NODE\SWEETIM|simapp_id, 1590556408121458687, In Quarantäne, [73938faf4537290da080444944c0eb15]
PUP.Optional.InstallCore.A, HKU\S-1-5-21-3697939779-1139795273-3143350014-1000.bak-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0X2O1C0R2R1R, In Quarantäne, [dd2950ee423a45f1f740b8d446beda26]
PUP.Optional.SweetIM.A, HKU\S-1-5-21-3697939779-1139795273-3143350014-1000.bak-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SWEETIM|simapp_id, 1590556408121458687, In Quarantäne, [62a446f8d8a40630ab74c7c6df2555ab]

Registrierungsdaten: 3
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=, Gut: (www.google.com), Schlecht: (hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=),Ersetzt,[ef17ef4f671549edeb9c1935c63f14ec]
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\ABOUTURLS|Tabs, hxxp://start.mysearchdial.com/?f=2&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=, Gut: (www.google.com), Schlecht: (hxxp://start.mysearchdial.com/?f=2&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=),Ersetzt,[5bab38063943cc6a67d55beaf60fb64a]
PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=, Gut: (www.google.com), Schlecht: (hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=),Ersetzt,[6f97f846c5b790a64740c28cf90c7f81]

Ordner: 30
PUP.Optional.OpenCandy, C:\Users\Frank\AppData\Roaming\OpenCandy, In Quarantäne, [37cfe75768145fd703a1a95fc53eb54b], 
PUP.Optional.OpenCandy, C:\Users\Frank\AppData\Roaming\OpenCandy\18B89208495841F38C0BB60ED78CE600, In Quarantäne, [37cfe75768145fd703a1a95fc53eb54b], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\browser, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\newtab, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\defaults, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\defaults\preferences, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\external, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\icons, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\resources, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\chrome, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\favorites, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\info, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\resources, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\_locales, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\_locales\en-US, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.SystemSpeedup, C:\Users\Frank\AppData\Roaming\systweak\ssd, In Quarantäne, [ec1a71cdf785ee48a68452cfb3509e62], 
PUP.Optional.Updater.A, C:\Users\Frank\AppData\Roaming\DigitalSites\UpdateProc, In Quarantäne, [33d3dc624b31f73fc84b70b67d8641bf], 

Dateien: 172
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\searchplugins\Mysearchdial.xml, In Quarantäne, [cb3bd46a0b7137ffeef4a6c529da6c94], 
PUP.Optional.DigitalSites.A, C:\Windows\System32\Tasks\Digital Sites, In Quarantäne, [08fe043a493361d5ab7fbcf946be10f0], 
PUP.Optional.OpenCandy, C:\Users\Frank\AppData\Roaming\OpenCandy\18B89208495841F38C0BB60ED78CE600\Trial-14.0.1000.89_de-DE_1004732_DE-1.exe, In Quarantäne, [37cfe75768145fd703a1a95fc53eb54b], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\chrome.manifest, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\install.rdf, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\.DS_Store, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\browser\.background.jsm.swp, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\browser\background.jsm, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\browser\bg.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\browser\browser.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\browser\browser.xul, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\browser\timer.jsm, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data\favorites_de.json, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data\favorites_en-gb.json, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data\favorites_en_us.json, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data\favorites_fr.json, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data\favorites_he.json, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data\favorites_it.json, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data\favorites_pt-br.json, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data\favorites_ru.json, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\data\favorites_tr.json, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external\crypto-js.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external\jquery-2.0.2.min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external\jquery.autocomplete.min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external\jquery.balloon.min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external\jquery.fittext.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external\jquery.Jcrop.min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external\jquery.simplecolorpicker.min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external\mustache.min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external\string.min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\external\underscore-min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\newtab\gallery.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\newtab\gallery.min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\newtab\newtab.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\newtab\newtab.min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\newtab\search.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\content\newtab\search.min.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\defaults\preferences\prefs-sys.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\defaults\preferences\prefs.js, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\external\foundation.min.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\external\indicator.gif, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\external\Jcrop.gif, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\external\jquery.autocomplete.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\external\jquery.Jcrop.min.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\external\jquery.simplecolorpicker.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\external\normalize.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery\arrow-gallery-cat-selected.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery\arrow.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery\emptyArea.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery\gallery.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery\gallery_templates.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery\icon-gallery-search.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery\not_available_32.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery\plus.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery\Thumbs.db, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\gallery\X.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\icons\128.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\icons\16.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\icons\48.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\icons\Thumbs.db, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\css\buttons.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\css\footer.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\css\header.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\css\list.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\css\newtab.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\css\search.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\css\themes.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\ajax-loader-2.gif, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\ajax-loader-bar.gif, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\ajax-loader-medium.gif, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\ajax-loader-small.gif, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\ajax-loader.gif, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\arrow-footer.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\arrow-header.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\attachment.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\close.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\edit-button.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\icon-chrome.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\icon-edit.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\icon-layout.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\icon-plus.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\icon-theme.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\menu_v.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\provider.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\Thumbs.db, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\x-button.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\arab_tile.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\batthern_@2X.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\bo_play_pattern_@2X.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\dark_wood_@2X.jpg, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\diagonal_striped_brick.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\escheresque_ste_@2X.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\gold_scale.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\purty_wood_@2X.jpg, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\readme.txt, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\starring_@2X.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\tileable_wood_texture_@2X.jpg, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\weave_@2X.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\wild_oliva_@2X.jpg, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\images\patterns\woven.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\resources\list.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\newtab\resources\menu.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\css\activetabs.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\css\favorites.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\css\layout.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\css\modal-fav-add.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\css\modal-fav-edit.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\css\modal-fav-group.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\css\recentlyclosed.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\css\theme.css, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\chrome\bookmarks.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\chrome\download.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\chrome\downloads.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\chrome\downloas.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\chrome\extensions.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\chrome\history.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\chrome\settings.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\chrome\trash.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\favorites\empty.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\favorites\error.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\favorites\shadow.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\info\contactus.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\info\facebook.ico, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\info\rateus.png, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\images\info\twitter.ico, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\resources\activetabs.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\resources\favorites.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\resources\layout.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\resources\modal-fav-add.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\resources\modal-fav-edit.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\resources\modal-fav-group.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\resources\recentlyclosed.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\skin\plugins\resources\theme.html, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}\_locales\en-US\translations.dtd, In Quarantäne, [ff07b589c7b5c96d05386ca25aa91ee2], 
PUP.Optional.SystemSpeedup, C:\Users\Frank\AppData\Roaming\systweak\ssd\SSDPTstub.exe, In Quarantäne, [ec1a71cdf785ee48a68452cfb3509e62], 
PUP.Optional.Updater.A, C:\Users\Frank\AppData\Roaming\DigitalSites\UpdateProc\config.dat, In Quarantäne, [33d3dc624b31f73fc84b70b67d8641bf], 
PUP.Optional.Updater.A, C:\Users\Frank\AppData\Roaming\DigitalSites\UpdateProc\info.dat, In Quarantäne, [33d3dc624b31f73fc84b70b67d8641bf], 
PUP.Optional.Updater.A, C:\Users\Frank\AppData\Roaming\DigitalSites\UpdateProc\prod.dat, In Quarantäne, [33d3dc624b31f73fc84b70b67d8641bf], 
PUP.Optional.Updater.A, C:\Users\Frank\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT, In Quarantäne, [33d3dc624b31f73fc84b70b67d8641bf], 
PUP.Optional.Updater.A, C:\Users\Frank\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT, In Quarantäne, [33d3dc624b31f73fc84b70b67d8641bf], 
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ({"backup":{"_signature":"SJICwOlu21EE5gCf5Y2I8z0GLyYg4ZDvzkXkng+pXZI=","_version":4,"extensions":{"ids":["ahfgeienlihckogmohjhadlkjgocpleb","blpcfgokakmgnkcojhhkbfbldkacnbeo","coobgpohoikkiipiblmjeljniedjpjpf","ndibdjnfmopecpmkdieinmbadjfpblof","pjkljhegncpnkpknbcohdijeoejaedia"]},"homepage":"hxxp://www.google.com/","homepage_is_newtabpage":false,"session":{"restore_on_startup":4,"urls_to_restore_on_startup":["hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=","hxxp://www.google.com/"]}},"browser":{"last_known_google_url":"hxxp://www.google.de/","last_prompted_google_url":"hxxp://www.google.de/","show_home_button":true,"window_placement":{"bottom":750,"left":10,"maximized":false,"right":1060,"top":10,"work_area_bottom":760,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":17477,"default_apps_install_state":1,"default_search_provider":{"id":"6","name":"Mysearchdial"},"distribution":{"create_all_shortcuts":true,"do_not_launch_chrome":true,"import_history":false,"import_search_engine":false,"make_chrome_default":true,"ping_delay":-60,"skip_first_run_ui":false,"verbose_logging":false},"dns_prefetching":{"host_referral_list":[2,["hxxp://www.google.com/",["hxxp://www.google.de/",2.60370040]],["hxxp://www.google.de/",["hxxp://ssl.gstatic.com/",2.27338020,"hxxp://www.google.com/",2.27338020,"hxxp://www.google.de/",4.58562160]],["https://2542116.fls.doubleclick.net/",["https://ad.yieldmanager.com/",3.92498120,"https://cm.g.doubleclick.net/",2.60370040,"https://cookex.amp.yahoo.com/",2.60370040,"https://g-pixel.invitemedia.com/",2.60370040,"https://googleads.g.doubleclick.net/",3.26434080,"https://segment-pixel.invitemedia.com/",2.60370040,"https://www.google.com/",2.60370040,"https://www.google.de/",2.60370040,"https://www.googleadservices.com/",3.5946610]],["https://plusone.google.com/",["https://plusone.google.com/",2.60370040]],["https://www.google.com/",["https://2542116.fls.doubleclick.net/",2.60370040,"https://apis.google.com/",2.60370040,"https://fls.doubleclick.net/",3.26434080,"https://fonts.googleapis.com/",2.27338020,"https://plusone.google.com/",2.60370040,"https://ssl.google-analytics.com/",2.60370040,"https://ssl.gstatic.com/",2.60370040,"https://themes.googleusercontent.com/",3.26434080,"https://tools.google.com/",2.27338020,"https://www.google.com/",6.23722260]]],"startup_list":[1,"hxxp://dnt.cloud.avg.com/","hxxp://tools.google.com/","hxxp://www.google.com/","hxxp://www.google.de/","https://apis.google.com/","https://fonts.googleapis.com/","https://ssl.google-analytics.com/","https://ssl.gstatic.com/","https://themes.googleusercontent.com/","https://www.google.com/"]},"download":{"directory_upgrade":true},"extensions":{"autoupdate":{"next_check":"13001721967375499"},"chrome_url_overrides":{"bookmarks":["chrome-extension://eemcgdkfndhakfknompkggombfjjjeno/main.html"],"newtab":["chrome-extension://ndibdjnfmopecpmkdieinmbadjfpblof/content/redirect.html"]},"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"app_launcher_ordinal":"n","page_ordinal":"n"},"blpcfgokakmgnkcojhhkbfbldkacnbeo":{"ack_external":true,"active_permissions":{"api":["appNotifications"]},"app_launcher_ordinal":"x","events":["runtime.onInstalled"],"from_bookmark":true,"from_webstore":true,"install_time":"13001704516736515","location":2,"manifest":{"app":{"launch":{"container":"tab","web_url":"hxxp://www.youtube.com/"},"web_content":{"enabled":true,"origin":"hxxp://www.youtube.com"}},"current_locale":"de","default_locale":"en","description":"Die beliebteste Online-Video-Community der Welt","icons":{"128":"128.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDC/HotmFlyuz5FaHaIbVBhhL4BwbcUtsfWwzgUMpZt5ZsLB2nW/Y5xwNkkPANYGdVsJkT2GPpRRIKBO5QiJ7jPMa3EZtcZHpkygBlQLSjMhdrAKevpKgIl6YTkwzNvExY6rzVDzeE9zqnIs33eppY4S5QcoALMxuSWlMKqgFQjHQIDAQAB","name":"YouTube","permissions":["appNotifications"],"update_url":"hxxp://clients2.google.com/service/update2/crx","version":"4.2.5"},"page_ordinal":"n","path":"blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.5_0","state":1},"coobgpohoikkiipiblmjeljniedjpjpf":{"ack_external":true,"app_launcher_ordinal":"t","events":["runtime.onInstalled"],"from_bookmark":true,"from_webstore":true,"install_time":"13001704514919515","location":2,"manifest":{"app":{"launch":{"web_url":"hxxp://www.google.com/webhp?source=search_app"},"urls":["*://www.google.com/search","*://www.google.com/webhp","*://www.google.com/imgres"]},"current_locale":"de","default_locale":"en","description":"Die schnellste Suche im Web.","icons":{"128":"128.png","16":"16.png","32":"32.png","48":"48.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIiso3Loy5VJHL40shGhUl6it5ZG55XB9q/2EX6aa88jAxwPutbCgy5d9bm1YmBzLfSgpX4xcpgTU08ydWbd7b50fbkLsqWl1mRhxoqnN01kuNfv9Hbz9dWWYd+O4ZfD3L2XZs0wQqo0y6k64n+qeLkUMd1MIhf6MR8Xz1SOA8pwIDAQAB","name":"Google-Suche","update_url":"hxxp://clients2.google.com/service/update2/crx","version":"0.0.0.19"},"page_ordinal":"n","path":"coobgpohoikkiipiblmjeljniedjpjpf\\0.0.0.19_0","state":1},"jimlgadlmmpnoagdcbciogmhpoeejhon":{"active_permissions":{"api":["cookies","plugin","tabs"],"explicit_host":["hxxp://*/*","https://*/*"],"scriptable_host":["hxxp://*/*","https://*/*"]},"creation_flags":1,"from_bookmark":false,"from_webstore":false,"granted_permissions":{"api":["cookies","plugin","tabs"],"explicit_host":["hxxp://*/*","https://*/*"],"scriptable_host":["hxxp://*/*","https://*/*"]},"install_time":"13007728238777604","location":1,"manifest":{"background":{"page":"background.html"},"content_scripts":[{"all_frames":true,"exclude_globs":["hxxp://api01.bloson.com/plugin_Ads.php*"],"js":["js/content.js","js/config.js","js/globals.js"],"matches":["hxxp://*/*","https://*/*"],"run_at":"document_start"},{"all_frames":false,"exclude_globs":["hxxp://api01.bloson.com/plugin_Ads.php*"],"js":["js/utils.js","js/config.js","js/addToSearch.js"],"matches":["hxxp://*/*","https://*/*"],"run_at":"document_start"}],"content_security_policy":"script-src 'self'; object-src 'self'","description":"Simply download this app, collect points while surfing and transform them into cash for your cause. It's free!","icons":{"128":"images/3979-b.png","48":"images/3979-b.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC5H77ynlYFwJECXIaLFoONf48e4wbpw8l8Vn83ct7igSt+xZjWV73Vu8igCz1y/ieVCrqvC4Ps5zrnJe0HADv8Za8DsJLmR38kAov80J7HURrLsplmzyEy5yp3ctH2ysJ6Tiy/K7nRRF3PTOEvenmpOoJo3a81E8LE3iKwVqreHwIDAQAB","manifest_version":2,"name":"Bloson","permissions":["tabs","cookies","hxxp://*/*","https://*/*"],"plugins":[{"path":"npapi-file-io-32.dll","public":true}],"update_url":"hxxp://www.bloson.com/updates/installcore/update_cr.xml","version":"1.0.16.2","web_accessible_resources":["images/3755-favicon.png","images/b_logo.png","images/bg.png","images/bloson_ads_small.png","images/bloson_ads.png","blosonLoginIframe.html","blosonMainIframe.html","blosonNotificationIframe_1.html","blosonUpdateNotification.html"]},"path":"jimlgadlmmpnoagdcbciogmhpoeejhon\\1.0.16.2_0","state":1,"was_installed_by_default":false},"ndibdjnfmopecpmkdieinmbadjfpblof":{"active_permissions":{"api":["plugin","tabs","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["hxxp://*/*","hxxp://dnt.cloud.avg.com/*","hxxp://dntf.cloud.avg.com/*","https://*/*"],"scriptable_host":["hxxp://*/*","hxxp://toolbar.avg.com/*","https://*/*"]},"events":["runtime.onInstalled"],"from_bookmark":false,"from_webstore":false,"install_time":"13001704513496515","location":3,"manifest":{"background_page":"content/background.html","browser_action":{"default_icon":"content/icons/avg_icon_16.png","default_title":"AVG Do Not Track"},"chrome_url_overrides":{"newtab":"content/redirect.html"},"content_scripts":[{"all_frames":true,"js":["content/js/content.js"],"matches":["hxxp://*/*","https://*/*"],"run_at":"document_start"},{"js":["content/js/ntinject.js"],"matches":["hxxp://toolbar.avg.com/*"]}],"current_locale":"de","default_locale":"en","description":"AVG Secure Search","icons":{"128":"content/icons/128-AVG-logo.png","16":"content/icons/16-AVG-logo.png","48":"content/icons/48-AVG-logo.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaBhCcd8V6V8SwALoaT+A51wnypeg3PtHPFZ6/1OKPFykl5ejJUJj4iBdO6hwupZS9r69OFb9AF0NPAxXqMfuh/mVqguifgJiqVV7tLaQ5tGAIy0pACKYaTICVePngldEIu1VNSf8A+YoQIt0LL7arZL5E/0iIoqX4Yd04Q8X2HwIDAQAB","name":"AVG Secure Search","options_page":"content/options.html","permissions":["tabs","plugin","webRequest","webRequestBlocking","hxxp://*/*","https://*/*","hxxp://dnt.cloud.avg.com/","hxxp://dntf.cloud.avg.com/"],"version":"13.2.0.4"},"path":"ndibdjnfmopecpmkdieinmbadjfpblof\\13.2.0.4_0","state":1},"pjkljhegncpnkpknbcohdijeoejaedia":{"ack_external":true,"active_permissions":{"api":["notifications"]},"app_launcher_ordinal":"w","events":["runtime.onInstalled"],"from_bookmark":false,"from_webstore":true,"install_time":"13001704515636515","location":2,"manifest":{"app":{"launch":{"container":"tab","web_url":"https://mail.google.com/mail/ca"},"urls":["*://mail.google.com/mail/ca"]},"current_locale":"de","default_locale":"en","description":"Schneller E-Mail-Dienst mit Suchfunktion und wenig Spam.","icons":{"128":"128.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCuGglK43iAz3J9BEYK/Mz6ZhloIMMDqQSAaf3vJt4eHbTbSDsu4WdQ9dQDRcKlg8nwQdePBt0C3PSUBtiSNSS37Z3qEGfS7LCju3h6pI1Yr9MQtxw+jUa7kXXIS09VV73pEFUT/F7c6Qe8L5ZxgAcBvXBh1Fie63qb02I9XQ/CQIDAQAB","name":"Google Mail","options_page":"https://mail.google.com/mail/ca/#settings","permissions":["notifications"],"update_url":"hxxp://clients2.google.com/service/update2/crx","version":"7"},"page_ordinal":"n","path":"pjkljhegncpnkpknbcohdijeoejaedia\\7_0","state":1}},"toolbar":["ndibdjnfmopecpmkdieinmbadjfpblof"],"toolbarsize":-1},"first_run_tabs":["hxxp://www.google.com/","hxxp://welcome_page"],"homepage":"hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=","homepage_is_newtabpage":false,"ntp":{"promo_resource_cache_update":"1357230915.393515"},"plugins":{"enabled_internal_pdf3":true,"enabled_nacl":true,"migrated_to_pepper_flash":true},"profile":{"avatar_index":0,"content_settings":{"clear_on_exit_migrated":true,"pref_version":1},"exited_cleanly":true,"name":"Erster Nutzer"},"promo":{"ntp_notification_promo":[{"closed":false,"end":1357685940,"gplus_required":false,"group":0,"increment":1,"increment_frequency":0,"increment_max":1,"max_views":15,"num_groups":1,"segment":1,"start":1356303600,"text":"Haben Sie ein Smartphone oder Tablet? <a href=\"https://www.google.com/chrome/mobile/?utm_source=chrome&utm_medium=ntp&utm_campaign=ntp-promo\">Holen Sie sich Chrome Mobile</a>","views":0}]},"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"urls_to_restore_on_startup":["hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=","hxxp://www.google.com/"]},"sync_promo":{"show_on_first_run_allowed":false}}), Ersetzt,[1cea5be3443857dfe0c82f5746bf7090]
PUP.Optional.MySearch.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (user_pref("extensions.irmysearch.aflt", "dsites0103");), Ersetzt,[a66078c6b7c51620a969058148bd08f8]
PUP.Optional.MySearch.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (searchdial.hmpg", true);
user_pref("extensions.), Ersetzt,[5fa77bc3f488979fac6661259a6ba858]
PUP.Optional.MySearch.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (ons.mysearchdial.hmpg", true);
user_pref("extensio), Ersetzt,[42c495a9285443f3977b2c5a65a08d73]
PUP.Optional.MySearch.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B), Ersetzt,[25e156e8314b3afce62ce79fc540c13f]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (user_pref("extensions.mysearchdial.hmpg", true);), Ersetzt,[df2790ae0f6d9e988a91f49226df7e82]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (sions.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1C), Ersetzt,[2ed8bd810e6e1d191efd5e28e520718f]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutB), Ersetzt,[3dc90b334d2fcf675dbe6323f90c60a0]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (s.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdia), Ersetzt,[3cca1e20f389d56161ba9fe77a8b5fa1]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (ial.hmpg", true);
user_pref("extensions.mysearchd), Ersetzt,[d82e7ec0324a1d19df3ce0a6a560ee12]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (ons.mysearchdial.hmpg", true);
user_pref("extensions), Ersetzt,[c93d320cd3a968cee239dea83ec71de3]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAt), Ersetzt,[d82e6bd3512b9b9b011a2d59b45148b8]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (zu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=");
user_pref("extensions.mysearchdial.dfltSrch", true);
user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");
user_pref("extensions.mysearchdial.dn), Ersetzt,[c34348f64b31b1858695aed8f90cd22e]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (ByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=2), Ersetzt,[38ceb28ca1dbb97d5cbf7610ad582cd4]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (chdial.hmpg", true);
user_pref("extensions.mysearchdia), Ersetzt,[57af1e20bdbf360069b20c7a669f8d73]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (ysearchdial.hmpg", true);
user_pref("extensions.mysea), Ersetzt,[6b9b201e2c50e4525dbe1a6c41c4cb35]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (mysearchdial.hmpg", true);
user_pref("extensions.mysea), Ersetzt,[0df9d46a6d0fbe7837e4295df114e818]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (ysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmp), Ersetzt,[2ed8093580fc6cca9f7c9aece61f837d]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (l.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl",), Ersetzt,[50b6dc6286f6c4725dbe0d79ff0636ca]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (hdial.hmpg", true);
user_pref("extensions.mysearchdial.hmp), Ersetzt,[a75f2b13a7d5de5831ea186e9d68be42]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (rchdial.hmpg", true);
user_pref("extensions.mysearchdia), Ersetzt,[c541a29c3844043276a5d4b26c999c64]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (searchdial.hmpg", true);
user_pref("extensions.mysearc), Ersetzt,[3ec878c6a9d337ffd04b3a4c26df3ec2]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (ysearchdial.hmpg", true);
user_pref("extensions.mys), Ersetzt,[f610102e9ae2a195011ae1a54cb951af]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (s.mysearchdial.hmpg", true);
user_pref("extension), Ersetzt,[7c8add614735f83ef625f2943acb5ea2]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (ons.mysearchdial.hmpg", true);
user_pref("extens), Ersetzt,[f70f6fcfa3d9ba7c4bd05e287c89e41c]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (ions.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "http:/), Ersetzt,[49bdfe40c8b45dd9ae6d780ec045ac54]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (r_pref("extensions.mysearchdial.hmpgUrl", "hxxp://st), Ersetzt,[1fe72618611b51e59e7da5e175908a76]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (.mysearchdial.hmpg", true);
user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A), Ersetzt,[c541f945c7b5cc6a25f6c9bd38cde020]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC), Ersetzt,[848297a74933bf7732e9b8cec93ce020]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites0103&cd=2XzuyEtN2Y1L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=");), Ersetzt,[ea1cc678c0bc3df92cf0a9dd778e0af6]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: ("Mysearchdial");
user_pref("extensions.mysearchdial.dnsErr", true);
user_pref("extensions.mysearchdial_i.newTab", false);
user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=dsites0103&cd=2XzuyEtN2), Ersetzt,[0303ec521d5f6bcb100c70160401c838]
PUP.Optional.MySearchDial.A, C:\Users\Frank\AppData\Roaming\Mozilla\Firefox\Profiles\kvcxyqmt.default\user.js, Gut: (), Schlecht: (L1QzutDtDtC0FtA0B0B0A0A0FyBzytCtByD0DtN0D0Tzu0SyByBzztN1L2XzutBtFtBtFtCyDtFtCyCtAtCtN1L1CzutBtAtDtC1N1R&cr=236298802&ir=");
user_pref("extensions.mysearchdial.dfltSrch", true);
user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdia), Ersetzt,[0bfb340acbb1cd69c3598501669f01ff]

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Ich versuche jetzt nochmal die Logfiles beizufügen... Die JRT.txt kann ich leider nicht mehr finden. Irgendeine Ahnung wo ich noch suchen kann?

Code:

ATTFilter

# AdwCleaner v4.105 - Bericht erstellt am 12/12/2014 um 18:14:36
# Aktualisiert 08/12/2014 von Xplode
# Database : 2014-12-08.2 [Live]
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : Frank - FRANK-LAPTOP
# Gestartet von : C:\Windows\system32\config\systemprofile\Desktop\AdwCleaner_4.105.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : vToolbarUpdater18.1.9

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\AVG Secure Search
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\open it!
Ordner Gelöscht : C:\Program Files (x86)\AVG Secure Search
Ordner Gelöscht : C:\Program Files (x86)\openit
Ordner Gelöscht : C:\Program Files (x86)\Common Files\AVG Secure Search
Datei Gelöscht : C:\Windows\System32\roboot64.exe

***** [ Tasks ] *****

Task Gelöscht : Digital Sites

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Security Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\openit open it!

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17420


*************************

AdwCleaner[R0].txt - [6776 octets] - [12/12/2014 18:12:38]
AdwCleaner[S0].txt - [6615 octets] - [12/12/2014 18:14:36]

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [6675 octets] ##########

fracar · 12.12.2014, 19:38

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 01
Ran by Frank (administrator) on FRANK-LAPTOP on 12-12-2014 18:36:48
Running from C:\Windows\System32\config\systemprofile\Desktop
Loaded Profile: Frank (Available profiles: Frank)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AuviTran SARL) C:\Program Files (x86)\AuviTran\AVS-Monitor\AVS-Service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Audinate Pty. Ltd.) C:\Program Files (x86)\Audinate\Shared Files\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(O2Micro International) C:\Windows\System32\drivers\o2flash.exe
(Audinate Pty. Ltd.) C:\Program Files (x86)\Audinate\Shared Files\conmon_cmm_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgui.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2710856 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-03] (CANON INC.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411952 2014-11-04] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-07-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] ()
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [140640 2009-09-28] (CANON INC.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3697939779-1139795273-3143350014-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKU\S-1-5-21-3697939779-1139795273-3143350014-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKU\S-1-5-21-3697939779-1139795273-3143350014-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x0C427F14A90DD001
HKU\S-1-5-21-3697939779-1139795273-3143350014-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Winsock: Catalog5 08 C:\Program Files (x86)\Audinate\Shared Files\mdnsNSP.dll [170800] (Audinate Pty. Ltd.)
Winsock: Catalog5-x64 08 C:\Program Files\Audinate\Shared Files\mdnsNSP.dll [179712] (Audinate Pty. Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2013-01-05] () [File not signed]
R2 AuviTranESoundService; C:\Program Files (x86)\AuviTran\AVS-Monitor\AVS-Service.exe [541032 2012-12-10] (AuviTran SARL)
R2 avgfws; C:\Program Files (x86)\AVG\AVG2013\avgfws.exe [1432592 2014-11-04] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4942384 2014-10-17] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-11-20] (AVG Technologies CZ, s.r.o.)
R2 conmon; C:\Program Files (x86)\Audinate\Shared Files\conmon_cmm_service.exe [309064 2014-05-13] (Audinate Pty. Ltd.)
R2 DanteDiscovery; C:\Program Files (x86)\Audinate\Shared Files\mDNSResponder.exe [426800 2014-05-13] (Audinate Pty. Ltd.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S4 Ksidowsraw; No ImagePath

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [50296 2012-09-04] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [209720 2014-11-04] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-10-23] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2014-10-17] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-11] (AVG Technologies)
R2 ESDriver; C:\Windows\System32\DRIVERS\ESDriver.sys [69120 2009-07-06] (Digigram)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-12] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R3 O2MDRDR; C:\Windows\System32\DRIVERS\o2mdx64.sys [64160 2009-07-13] (O2Micro )
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [90928 2012-03-01] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [632752 2012-03-01] (Paragon)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [53760 2012-09-28] (Apple, Inc.) [File not signed]
S3 ysusb64; C:\Windows\System32\drivers\ysusb64.sys [113960 2013-01-29] (Yamaha Corporation)
S3 athr; system32\DRIVERS\athrx.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-12 18:19 - 2014-12-12 18:19 - 00000000 ____D () C:\Windows\ERUNT
2014-12-12 18:12 - 2014-12-12 18:14 - 00000000 ____D () C:\AdwCleaner
2014-12-12 17:44 - 2014-12-12 18:19 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-12 17:44 - 2014-12-12 17:44 - 00001119 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-12 17:44 - 2014-12-12 17:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-12 17:44 - 2014-12-12 17:44 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-12 17:44 - 2014-12-12 17:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-12 17:44 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-12 17:44 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-12 17:44 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-12 17:38 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-12 17:38 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-12 17:38 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-12-12 17:38 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-12-12 17:38 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-12-12 17:38 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-12-12 17:38 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-12-12 17:38 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-12-12 17:38 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-12-12 17:38 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-12-11 18:09 - 2014-12-12 18:11 - 00000000 ____D () C:\Windows\SysWOW64\cache
2014-12-11 17:58 - 2014-12-11 18:04 - 00000000 ____D () C:\ComboFix
2014-12-11 17:58 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-11 17:58 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-11 17:58 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-11 17:58 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-11 17:58 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-11 17:58 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-11 17:58 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-11 17:58 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-11 17:57 - 2014-12-11 18:04 - 00000000 ____D () C:\Qoobox
2014-12-11 17:57 - 2014-12-11 18:03 - 00000000 ____D () C:\Windows\erdnt
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default\AppData\Local\EmieUserList
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default\AppData\Local\EmieSiteList
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default\AppData\Local\EmieBrowserModeList
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default User\AppData\Local\EmieUserList
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default User\AppData\Local\EmieSiteList
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default User\AppData\Local\EmieBrowserModeList
2014-12-08 14:17 - 2014-12-12 18:36 - 00000000 ____D () C:\FRST
2014-12-01 22:00 - 2014-12-01 22:00 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\Apple Computer
2014-12-01 22:00 - 2014-12-01 22:00 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Apple Computer
2014-12-01 22:00 - 2014-12-01 22:00 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-12-01 21:52 - 2014-12-01 21:52 - 00000000 ____D () C:\Windows\system32\%LocalAppData%
2014-12-01 20:07 - 2014-12-01 20:07 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\MFAData
2014-12-01 16:07 - 2014-12-01 16:07 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Apple
2014-12-01 15:23 - 2014-12-01 17:22 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Avg2013
2014-12-01 15:23 - 2014-12-01 16:34 - 00000000 ___RD () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-12-01 15:23 - 2014-12-01 16:34 - 00000000 ___RD () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-01 15:23 - 2014-12-01 16:34 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\AVG2013
2014-12-01 15:23 - 2013-03-21 14:48 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Microsoft Help
2014-12-01 15:23 - 2012-12-31 11:55 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\TuneUp Software
2014-11-27 19:46 - 2014-11-27 19:46 - 00274432 _____ () C:\Windows\Minidump\112714-23462-01.dmp
2014-11-19 21:55 - 2014-12-01 16:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-11-19 21:27 - 2014-11-19 21:27 - 00000000 __SHD () C:\Users\Frank\AppData\Local\EmieBrowserModeList
2014-11-19 04:26 - 2014-11-19 04:26 - 01614504 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL
2014-11-18 20:39 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-11-18 20:39 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-11-18 20:39 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-11-18 20:39 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-11-18 20:39 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-11-18 20:39 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-11-18 20:39 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-11-18 20:39 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-11-18 20:39 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-11-18 20:39 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-11-18 20:39 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-11-18 20:39 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-11-18 20:39 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-11-18 20:39 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-11-18 20:39 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-11-18 20:39 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-11-18 20:39 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-11-18 20:39 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-11-18 20:39 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-11-18 20:39 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-11-18 20:39 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-11-18 20:39 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-11-18 20:39 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-11-18 20:39 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-11-18 20:39 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-11-18 20:39 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-11-18 20:39 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-11-18 20:39 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-11-18 20:39 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-11-18 20:39 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-11-18 20:39 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-11-18 20:39 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-11-18 20:39 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-11-18 20:39 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-11-18 20:39 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-11-18 20:39 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-11-18 20:39 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-18 20:39 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-11-18 20:39 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-11-18 20:39 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-11-18 20:39 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-11-18 20:39 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-11-18 20:39 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-11-18 20:39 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-11-18 20:39 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-11-18 20:39 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-11-18 20:39 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-11-18 20:39 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-11-18 20:39 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-11-18 20:39 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-11-18 20:39 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-11-18 20:39 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-11-18 20:39 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-11-18 20:39 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-11-18 20:39 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-11-18 20:39 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-11-18 20:39 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-11-18 20:39 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-11-18 20:39 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-11-18 20:39 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-18 20:39 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-18 20:39 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-18 20:39 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-18 20:39 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-18 20:38 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-18 20:38 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-18 20:38 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-18 20:38 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-18 20:38 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-18 20:38 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-18 20:38 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-18 20:38 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-18 20:38 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-18 20:38 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-18 20:38 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-18 20:38 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-18 20:38 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-11-18 20:38 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-11-18 20:38 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-18 20:38 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-18 20:38 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-11-18 20:38 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-11-18 20:38 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-11-18 20:38 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-18 20:38 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-18 20:38 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-18 20:38 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-11-18 20:38 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-18 20:38 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-12 18:28 - 2013-01-03 17:28 - 00000000 ____D () C:\ProgramData\Adobe
2014-12-12 18:26 - 2012-12-31 14:39 - 01549854 _____ () C:\Windows\WindowsUpdate.log
2014-12-12 18:23 - 2009-07-14 05:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-12 18:23 - 2009-07-14 05:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-12 18:22 - 2011-04-12 08:43 - 00703214 _____ () C:\Windows\system32\perfh007.dat
2014-12-12 18:22 - 2011-04-12 08:43 - 00150822 _____ () C:\Windows\system32\perfc007.dat
2014-12-12 18:22 - 2009-07-14 06:13 - 01629372 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-12 18:16 - 2014-02-27 09:25 - 00079334 _____ () C:\Windows\PFRO.log
2014-12-12 18:16 - 2014-02-27 09:25 - 00016866 _____ () C:\Windows\setupact.log
2014-12-12 18:16 - 2013-01-06 14:12 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-12 18:16 - 2013-01-05 13:20 - 00000440 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-12 18:16 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-12 17:54 - 2014-02-16 13:34 - 00000000 ____D () C:\Users\Frank\AppData\Roaming\DigitalSites
2014-12-12 17:39 - 2012-12-31 13:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-12 17:35 - 2012-12-31 11:51 - 00000000 ____D () C:\ProgramData\MFAData
2014-12-11 18:03 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-12-09 14:57 - 2012-12-31 12:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-08 15:44 - 2013-01-06 14:12 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-01 16:35 - 2012-12-31 13:34 - 00002896 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-12-01 16:34 - 2014-05-07 17:11 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-01 16:34 - 2012-12-31 13:34 - 00000000 ____D () C:\Windows\AutoKMS
2014-12-01 16:34 - 2012-12-31 13:18 - 00000000 ____D () C:\Users\Frank\AppData\Roaming\Wise Registry Cleaner
2014-12-01 16:34 - 2012-12-31 12:49 - 00000000 ____D () C:\Windows\system32\Macromed
2014-12-01 16:34 - 2012-12-31 12:40 - 00000000 ____D () C:\Windows\Minidump
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\servicing
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\schemas
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-12-01 15:26 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-12-01 15:23 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-11-19 19:45 - 2014-02-27 09:26 - 00119032 _____ () C:\Users\Frank\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-19 19:44 - 2014-02-27 09:25 - 00444952 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-19 01:01 - 2013-09-12 15:08 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-19 00:59 - 2012-10-11 00:16 - 103374192 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-19 00:14 - 2013-01-02 13:45 - 00000000 ____D () C:\Users\Frank\Documents\Outlook-Dateien
2014-11-18 15:57 - 2012-12-31 12:49 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-18 15:57 - 2012-12-31 12:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-18 15:57 - 2012-12-31 12:49 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-18 15:39 - 2013-03-06 14:45 - 00016500 ____H () C:\Users\Frank\Desktop\~WRL0290.tmp
2014-11-18 15:39 - 2013-01-06 14:12 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-18 15:39 - 2013-01-06 14:12 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-18 15:26 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-08 15:49

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2014 01
Ran by Frank at 2014-12-12 18:37:24
Running from C:\Windows\System32\config\systemprofile\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG Internet Security 2013 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security 2013 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: AVG Internet Security 2013 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Photoshop CS (HKLM-x32\...\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}) (Version: CS - Adobe Systems, Inc.)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{914F7627-B645-9895-F723-BAEAAC865E75}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArrayCalc (HKLM-x32\...\{12A03609-5AED-42F5-853C-79A5309E80D6}) (Version: 6.7.15 - d&b audiotechnik GmbH)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
AuviTran AVS-Monitor (HKLM-x32\...\AuviTran AVS-Monitor) (Version:  - )
Auvitran Firmware Updater (HKLM-x32\...\Auvitran Firmware Updater) (Version:  - )
AVG 2013 (HKLM\...\AVG) (Version: 2013.0.3495 - AVG Technologies)
AVG 2013 (Version: 13.0.3495 - AVG Technologies) Hidden
AVG 2013 (Version: 13.0.4235 - AVG Technologies) Hidden
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v8.00.12(T) - TOSHIBA CORPORATION)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother P-touch Editor 4.2 (HKLM-x32\...\InstallShield_{003447F5-0058-4B77-9C1E-50488F77C4A7}) (Version: 4.2 - Brother Industries, Ltd.)
Brother P-touch Editor 4.2 (x32 Version: 4.2 - Brother Industries, Ltd.) Hidden
Brother P-touch Editor 5.0 (HKLM-x32\...\{DF9A6075-9308-4572-8932-A4316243C4D9}) (Version: 5.0.2300 - Brother Industries, Ltd.)
Brother P-touch Update Software (HKLM-x32\...\{A598BEC3-4F02-413E-9649-C5A1879DB558}) (Version: 1.0.0010 - Brother Industries, Ltd.)
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon Kurzwahlprogramm (HKLM-x32\...\Speed Dial Utility) (Version:  - )
Canon MP Navigator EX 3.1 (HKLM-x32\...\MP Navigator EX 3.1) (Version:  - )
Canon MX870 series Benutzerregistrierung (HKLM-x32\...\Canon MX870 series Benutzerregistrierung) (Version:  - )
Canon MX870 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX870_series) (Version:  - )
Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )
Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version:  - )
CAPS (HKLM-x32\...\{7FEA5EEA-91C7-4387-9585-682A98DE5EB3}) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 3.26 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.0.3717 - CDBurnerXP)
CrystalDiskInfo 5.1.0 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 5.1.0 - Crystal Dew World)
Dante Control and Monitoring (HKLM-x32\...\{32B9C78C-6BA0-456F-8053-5BA6305AEA37}) (Version: 1.7.8.2 - Audinate Pty. Ltd.)
Dante Controller (HKLM-x32\...\{de711cd0-3404-49b5-8d8b-251ceaf5ae35}) (Version: 3.5.3.1 - Audinate Pty. Ltd.)
Dante Controller (x32 Version: 3.5.3.1 - Audinate) Hidden
Dante Discovery (HKLM\...\{BB809BBB-7F71-402D-B0C0-603008B0BB59}) (Version: 1.0.5.1 - Audinate Pty. Ltd.)
Dante Firmware Update Manager (HKLM-x32\...\{60b610c7-22c6-4005-b252-181b2126425e}) (Version: 1.4.7.1 - Audinate Pty. Ltd.)
Dante Firmware Update Manager Core (x32 Version: 1.4.7.1 - Audinate Pty. Ltd.) Hidden
dsdminst (x32 Version: 1.01.0002 - Brother Industries, Ltd.) Hidden
EASE Focus 2 (HKLM-x32\...\InstallShield_{C5A2F0B5-6725-49A5-9E8E-A5FD86C07423}) (Version: 2.0.11 - AFMG)
EASE Focus 2 (x32 Version: 2.0.11 - AFMG) Hidden
EtherSound Runtime x64 v3.12 d (HKLM\...\{0751579A-00BC-425C-A9D9-E6C81A2C54CC}) (Version: 3.12.3 - EtherSound)
FirSoft build 908 - Firnet Controller Software (HKLM-x32\...\{D7820CF7-5420-42AA-B006-768911C8E001}_is1) (Version:  - HKaudio)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)
LG-FCB ControlCenter 1.1 (HKLM-x32\...\LG-FCB ControlCenter) (Version: 1.1 - GORDIUS)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
O2Micro Flash Memory Card Reader Driver (HKLM\...\{729F014A-9E91-49A6-B5F2-E8AA941452AE}) (Version: 3.31.03.A - O2Micro)
Paragon Festplatten Manager™ 12 Professional (HKLM-x32\...\{1E104AF0-EA49-11DE-AC07-005056C00008}) (Version: 90.00.0003 - Paragon Software)
PDF24 Creator 5.2.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PodWare (HKLM-x32\...\{2D9894BE-4FDD-4F2C-9A41-3B683CB90736}) (Version: 5.46.0 - Linea Research)
P-touch Editor 3.2 (HKLM-x32\...\P-touch Editor ver 3.2) (Version:  - )
QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
Soundcraft Virtual Vi 4.7.0 (HKLM-x32\...\SoundcraftVirtualVi) (Version: 4.7.0 - Soundcraft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN)
VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wise Registry Cleaner 7.61 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version:  - WiseCleaner.com, Inc.)
Yamaha Steinberg USB Driver (HKLM-x32\...\InstallShield_{E976141F-5B03-429D-84C2-392E6BB1A45A}) (Version: 1.7.3 - Yamaha Corporation)
Yamaha Steinberg USB Driver (Version: 1.7.3 - Yamaha Corporation) Hidden
YAMAHA THR Editor (HKLM-x32\...\{5115B75F-32BF-42CB-A8BC-2F0A71C4DF93}) (Version: 1.0.0 - Yamaha Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

27-11-2014 20:28:32 Geplanter Prüfpunkt
01-12-2014 14:29:34 Wiederherstellungsvorgang
12-12-2014 16:37:25 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-12-11 18:03 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1CA4762D-C498-470B-B41F-A6ED504F4C91} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-06] (Google Inc.)
Task: {41F32A97-0CC6-4647-A133-A35662D4A7B0} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2012-12-25] (WiseCleaner.com)
Task: {76701015-8E62-4CD8-A2D9-6D3484490910} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-06] (Google Inc.)
Task: {B1C44252-1BD1-4366-85BF-EF82418846E0} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {C1E86DA9-8445-4C1F-BF86-7CFD03D79E02} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {CCD56122-80F8-4F3D-BA52-5CF47A6C7235} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {E10BF578-A8DE-46D8-8BA2-C3849292AA99} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe
Task: {E391B2C1-86FD-4E6A-AAD9-EE90B988B698} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-12-19] (Piriform Ltd)
Task: {F1152E3B-7622-4801-81CF-6160718DE352} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-18] (Adobe Systems Incorporated)
Task: {F50D10E3-8870-4783-9998-8C1F4E85973F} - System32\Tasks\4679 => Wscript.exe C:\Users\Frank\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Wise Registry Cleaner Schedule Task.job => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe

==================== Loaded Modules (whitelisted) =============

2012-07-04 01:16 - 2012-07-04 01:16 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-3697939779-1139795273-3143350014-500 - Administrator - Enabled)
Frank (S-1-5-21-3697939779-1139795273-3143350014-1000 - Administrator - Enabled) => C:\Users\TEMP.FRANK-LAPTOP
Gast (S-1-5-21-3697939779-1139795273-3143350014-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3697939779-1139795273-3143350014-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/12/2014 06:26:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   20 46.178.168.192.in-addr.arpa. PTR Frank-Laptop.local.

Error: (12/12/2014 06:26:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.46:5353   22 46.178.168.192.in-addr.arpa. PTR Frank-Laptop-2.local.


System errors:
=============
Error: (12/12/2014 06:26:27 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0


Microsoft Office Sessions:
=========================
Error: (12/12/2014 06:26:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   20 46.178.168.192.in-addr.arpa. PTR Frank-Laptop.local.

Error: (12/12/2014 06:26:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.178.46:5353   22 46.178.168.192.in-addr.arpa. PTR Frank-Laptop-2.local.


CodeIntegrity Errors:
===================================
  Date: 2014-12-11 18:02:51.025
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-11 18:02:50.931
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T8100 @ 2.10GHz
Percentage of memory in use: 35%
Total physical RAM: 4094.43 MB
Available physical RAM: 2660.92 MB
Total Pagefile: 8187.04 MB
Available Pagefile: 6343.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (F1 - SSD Win7) (Fixed) (Total:111.79 GB) (Free:3.01 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (F2 - Hitachi) (Fixed) (Total:232.89 GB) (Free:176.03 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: () (Removable) (Total:1.86 GB) (Free:1.84 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 2D5D03CE)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 111.8 GB) (Disk ID: B2FC597E)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 1.9 GB) (Disk ID: E03BEF58)
Partition 1: (Not Active) - (Size=1.9 GB) - (Type=06)

==================== End Of Log ============================

fracar · 13.12.2014, 09:35

Hallo Schrauber,

... und außerdem gehen jetzt immer 2 Fenster auf, die ich mal abfotografiert habe. Irgendwas ist da noch faul...

DANKE !!!!!! und bis später...

schrauber · 13.12.2014, 20:18

Das erste Fenster kommt im IE? Ist normal, Haken setzen und Ok klicken.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

Task: {CCD56122-80F8-4F3D-BA52-5CF47A6C7235} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {F50D10E3-8870-4783-9998-8C1F4E85973F} - System32\Tasks\4679 => Wscript.exe C:\Users\Frank\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
S4 Ksidowsraw; No ImagePath
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Lade Dir bitte Windows Repair - All in one von tweaking.com hier herunter und installiere es.
Deaktiviere bitte (wenn möglich) Dein Antivirusprogramm.
Bedenke, dass die einzelnen Reparaturen einige Zeit benötigen. Starte keine anderen Anwendungen in dieser Zeit.
Starte das Programm und führe die Punkte 1-5 durch. (Siehe Bildanleitung)
Achte darauf, dass bei Dir die Häkchen so gesetzt sind wie unter Punkt 4.
Setze auch ein Häkchen bei "Restart/Shutdown System" und klicke "Restart System" an bevor Du Punkt 5 durchführst.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

fracar · 14.12.2014, 15:19

Hallo Schrauber,

ESET hab ich gemacht, anbei das Logfile.

Wollte jetzt auch "security check" downloaden, aber der download startet nicht, habe alle Downloads von nem anderen rechner gemacht, und die installationsdateien vom stick auf diesem rechner gestartet. das ging. vielleicht hilft das. melde mich wieder wenn ich "security check" gemacht habe...

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=9bd8bf2c9ef3224489ba09e9ae56d3dc
# engine=21545
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-12-14 01:32:20
# local_time=2014-12-14 02:32:20 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='AVG Internet Security 2013'
# compatibility_mode=1046 16777213 100 76 11615 105694324 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 39567631 170193790 0 0
# scanned=179855
# found=3
# cleaned=0
# scan_time=3290
sh=985AE5B998513B7D9C2749DF15CAE7C04C3BDC9E ft=1 fh=2f9831d32275f6eb vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\System32\roboot64.exe.vir"
sh=969F808AA2BABF85EE0DD7E5B6140020F387C246 ft=1 fh=acb3ca9361cfa9d7 vn="Variante von Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Frank\Downloads\SkypeSetup.exe"
sh=4C2A2C9A5483A7F9770BB37F09648C98BDDAAC77 ft=1 fh=4f3d94e690c2f780 vn="Win32/DomaIQ.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Frank\Downloads\zipper_V.4550452.exe"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.91  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Security Center service is not running! This report may not be accurate! 
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Wise Registry Cleaner 7.61  
 Adobe Reader XI  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 AVG avgwdsvc.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-12-2014
Ran by Frank (administrator) on FRANK-LAPTOP on 14-12-2014 14:53:06
Running from F:\
Loaded Profile: Frank (Available profiles: Frank)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AuviTran SARL) C:\Program Files (x86)\AuviTran\AVS-Monitor\AVS-Service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgfws.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Audinate Pty. Ltd.) C:\Program Files (x86)\Audinate\Shared Files\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(O2Micro International) C:\Windows\System32\drivers\o2flash.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgemca.exe
(Audinate Pty. Ltd.) C:\Program Files (x86)\Audinate\Shared Files\conmon_cmm_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2710856 2009-11-01] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-03] (CANON INC.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2013\avgui.exe [4411952 2014-11-04] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-07-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] ()
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [140640 2009-09-28] (CANON INC.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-01] (Apple Inc.)
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_246_ActiveX.exe [855216 2014-12-12] (Adobe Systems Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3697939779-1139795273-3143350014-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3697939779-1139795273-3143350014-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKU\S-1-5-21-3697939779-1139795273-3143350014-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Winsock: Catalog5 08 C:\Program Files (x86)\Audinate\Shared Files\mdnsNSP.dll [170800] (Audinate Pty. Ltd.)
Winsock: Catalog5-x64 08 C:\Program Files\Audinate\Shared Files\mdnsNSP.dll [179712] (Audinate Pty. Ltd.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2013-01-05] () [File not signed]
R2 AuviTranESoundService; C:\Program Files (x86)\AuviTran\AVS-Monitor\AVS-Service.exe [541032 2012-12-10] (AuviTran SARL)
R2 avgfws; C:\Program Files (x86)\AVG\AVG2013\avgfws.exe [1432592 2014-11-04] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4942384 2014-10-17] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-11-20] (AVG Technologies CZ, s.r.o.)
R2 conmon; C:\Program Files (x86)\Audinate\Shared Files\conmon_cmm_service.exe [309064 2014-05-13] (Audinate Pty. Ltd.)
R2 DanteDiscovery; C:\Program Files (x86)\Audinate\Shared Files\mDNSResponder.exe [426800 2014-05-13] (Audinate Pty. Ltd.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [50296 2012-09-04] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-07-20] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [209720 2014-11-04] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311608 2013-07-20] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-07-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-10-23] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2014-10-17] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-11] (AVG Technologies)
R2 ESDriver; C:\Windows\System32\DRIVERS\ESDriver.sys [69120 2009-07-06] (Digigram)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-14] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R3 O2MDRDR; C:\Windows\System32\DRIVERS\o2mdx64.sys [64160 2009-07-13] (O2Micro )
R1 UimBus; C:\Windows\System32\DRIVERS\uimx64.sys [90928 2012-03-01] (Windows (R) 2000 DDK provider)
R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IMx64.sys [632752 2012-03-01] (Paragon)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [53760 2012-09-28] (Apple, Inc.) [File not signed]
S3 ysusb64; C:\Windows\System32\drivers\ysusb64.sys [113960 2013-01-29] (Yamaha Corporation)
S3 athr; system32\DRIVERS\athrx.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-14 13:34 - 2014-12-14 13:34 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-12-14 13:01 - 2014-12-14 13:01 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-FRANK-LAPTOP-Microsoft-Windows-7-Ultimate-(64-bit).dat
2014-12-14 13:01 - 2014-12-14 13:01 - 00000000 ____D () C:\RegBackup
2014-12-14 12:46 - 2014-12-14 12:46 - 00003416 ____N () C:\bootsqm.dat
2014-12-14 12:41 - 2014-12-14 12:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2014-12-14 12:41 - 2014-12-14 12:41 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2014-12-14 10:09 - 2014-12-14 10:09 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-12 18:19 - 2014-12-12 18:19 - 00000000 ____D () C:\Windows\ERUNT
2014-12-12 18:14 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-12 18:14 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-12 18:14 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-12 18:14 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-12 18:14 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-12 18:14 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-12 18:14 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-12 18:14 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-12 18:14 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-12 18:14 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-12 18:14 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-12 18:14 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-12 18:14 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-12 18:14 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-12 18:14 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-12 18:14 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-12 18:14 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-12 18:14 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-12 18:14 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-12 18:14 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-12 18:14 - 2014-11-22 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-12 18:14 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-12 18:14 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-12 18:14 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-12 18:14 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-12 18:14 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-12 18:14 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-12 18:14 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-12 18:14 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-12 18:14 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-12 18:14 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-12 18:14 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-12 18:14 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-12 18:14 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-12 18:14 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-12 18:14 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-12 18:14 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-12 18:14 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-12 18:13 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-12 18:13 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-12 18:13 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-12 18:13 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-12 18:13 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-12 18:13 - 2014-11-22 03:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-12 18:13 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-12 18:13 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-12 18:13 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-12 18:13 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-12 18:13 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-12 18:13 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-12 18:13 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-12 18:13 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-12 18:13 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-12 18:13 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-12 18:13 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-12 18:13 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-12 18:12 - 2014-12-12 18:14 - 00000000 ____D () C:\AdwCleaner
2014-12-12 18:09 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-12 18:09 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-12 18:09 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-12 18:09 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-12 18:09 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-12 18:09 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-12 18:09 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-12 18:09 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-12 18:08 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-12 18:08 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-12 18:08 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-12 17:44 - 2014-12-14 13:29 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-12 17:44 - 2014-12-12 17:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-12 17:44 - 2014-12-12 17:44 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-12 17:44 - 2014-12-12 17:44 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-12 17:44 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-12 17:44 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-12 17:44 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-12 17:39 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-12 17:39 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-12 17:39 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-12 17:39 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-12 17:39 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-12 17:39 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-12 17:39 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-12 17:39 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-12 17:39 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-12 17:39 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-12 17:39 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-12 17:39 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-12 17:39 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-12 17:39 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-12 17:38 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-12 17:38 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-12 17:38 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-12-12 17:38 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-12-12 17:38 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-12-12 17:38 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-12-12 17:38 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-12-12 17:38 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-12-12 17:38 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-12-12 17:38 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-12-11 18:09 - 2014-12-12 18:11 - 00000000 ____D () C:\Windows\SysWOW64\cache
2014-12-11 17:58 - 2014-12-11 18:04 - 00000000 ____D () C:\ComboFix
2014-12-11 17:58 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-12-11 17:58 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-12-11 17:58 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-12-11 17:58 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-12-11 17:58 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-12-11 17:58 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-12-11 17:58 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-12-11 17:58 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-12-11 17:57 - 2014-12-11 18:04 - 00000000 ____D () C:\Qoobox
2014-12-11 17:57 - 2014-12-11 18:03 - 00000000 ____D () C:\Windows\erdnt
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default\AppData\Local\EmieUserList
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default\AppData\Local\EmieSiteList
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default\AppData\Local\EmieBrowserModeList
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default User\AppData\Local\EmieUserList
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default User\AppData\Local\EmieSiteList
2014-12-08 15:26 - 2014-12-08 15:26 - 00000000 __SHD () C:\Users\Default User\AppData\Local\EmieBrowserModeList
2014-12-08 14:17 - 2014-12-14 14:53 - 00000000 ____D () C:\FRST
2014-12-01 22:00 - 2014-12-01 22:00 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\Apple Computer
2014-12-01 22:00 - 2014-12-01 22:00 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Apple Computer
2014-12-01 22:00 - 2014-12-01 22:00 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-12-01 21:52 - 2014-12-01 21:52 - 00000000 ____D () C:\Windows\system32\%LocalAppData%
2014-12-01 20:07 - 2014-12-01 20:07 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\MFAData
2014-12-01 16:07 - 2014-12-01 16:07 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Apple
2014-12-01 15:23 - 2014-12-01 17:22 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Avg2013
2014-12-01 15:23 - 2014-12-01 16:34 - 00000000 ___RD () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-12-01 15:23 - 2014-12-01 16:34 - 00000000 ___RD () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-01 15:23 - 2014-12-01 16:34 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\AVG2013
2014-12-01 15:23 - 2013-03-21 14:48 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Local\Microsoft Help
2014-12-01 15:23 - 2012-12-31 11:55 - 00000000 ____D () C:\Users\TEMP.FRANK-LAPTOP\AppData\Roaming\TuneUp Software
2014-11-27 19:46 - 2014-11-27 19:46 - 00274432 _____ () C:\Windows\Minidump\112714-23462-01.dmp
2014-11-19 21:55 - 2014-12-01 16:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-11-19 21:27 - 2014-11-19 21:27 - 00000000 __SHD () C:\Users\Frank\AppData\Local\EmieBrowserModeList
2014-11-19 04:26 - 2014-11-19 04:26 - 01614504 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL
2014-11-18 20:39 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-11-18 20:39 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-11-18 20:39 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-11-18 20:39 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-11-18 20:39 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-11-18 20:38 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-11-18 20:38 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-11-18 20:38 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-11-18 20:38 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-11-18 20:38 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-11-18 20:38 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-11-18 20:38 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-11-18 20:38 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-11-18 20:38 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-11-18 20:38 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-11-18 20:38 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-11-18 20:38 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-11-18 20:38 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-11-18 20:38 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-11-18 20:38 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-11-18 20:38 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-11-18 20:38 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-11-18 20:38 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-11-18 20:38 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-11-18 20:38 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-11-18 20:38 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-11-18 20:38 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-11-18 20:38 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-11-18 20:38 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-11-18 20:38 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-11-18 20:38 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-11-18 20:38 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-11-18 20:38 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-14 14:44 - 2013-01-06 14:12 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-14 13:57 - 2012-12-31 12:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-14 13:28 - 2011-04-12 08:43 - 00689352 _____ () C:\Windows\system32\perfh007.dat
2014-12-14 13:28 - 2011-04-12 08:43 - 00146652 _____ () C:\Windows\system32\perfc007.dat
2014-12-14 13:28 - 2009-07-14 06:13 - 01629372 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-14 13:16 - 2009-07-14 03:34 - 00000514 _____ () C:\Windows\win.ini
2014-12-14 13:13 - 2013-01-05 13:20 - 00000442 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-12-14 13:12 - 2012-12-31 14:39 - 01916843 _____ () C:\Windows\WindowsUpdate.log
2014-12-14 13:01 - 2012-12-31 11:51 - 00000000 ____D () C:\ProgramData\MFAData
2014-12-14 12:54 - 2009-07-14 05:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-14 12:54 - 2009-07-14 05:45 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-14 12:47 - 2013-01-06 14:12 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-14 12:46 - 2014-02-27 09:25 - 00079686 _____ () C:\Windows\PFRO.log
2014-12-14 12:46 - 2014-02-27 09:25 - 00017202 _____ () C:\Windows\setupact.log
2014-12-14 12:46 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-14 10:09 - 2014-05-07 17:11 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-14 10:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-14 10:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-12 20:16 - 2013-09-12 15:08 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-12 20:15 - 2012-10-11 00:16 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-12 20:14 - 2012-12-31 13:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-12 18:57 - 2012-12-31 12:49 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-12 18:57 - 2012-12-31 12:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-12 18:57 - 2012-12-31 12:49 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-12-12 18:28 - 2013-01-03 17:28 - 00000000 ____D () C:\ProgramData\Adobe
2014-12-12 17:54 - 2014-02-16 13:34 - 00000000 ____D () C:\Users\Frank\AppData\Roaming\DigitalSites
2014-12-11 18:03 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-12-11 18:03 - 2009-07-14 03:34 - 00000027 _____ () C:\Windows\system32\Drivers\etc\hosts_bak_633
2014-12-01 16:35 - 2012-12-31 13:34 - 00002896 _____ () C:\Windows\System32\Tasks\AutoKMS
2014-12-01 16:34 - 2012-12-31 13:34 - 00000000 ____D () C:\Windows\AutoKMS
2014-12-01 16:34 - 2012-12-31 13:18 - 00000000 ____D () C:\Users\Frank\AppData\Roaming\Wise Registry Cleaner
2014-12-01 16:34 - 2012-12-31 12:49 - 00000000 ____D () C:\Windows\system32\Macromed
2014-12-01 16:34 - 2012-12-31 12:40 - 00000000 ____D () C:\Windows\Minidump
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\servicing
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\schemas
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-12-01 16:34 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-12-01 15:26 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-12-01 15:23 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-11-19 19:45 - 2014-02-27 09:26 - 00119032 _____ () C:\Users\Frank\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-19 19:44 - 2014-02-27 09:25 - 00444952 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-19 00:14 - 2013-01-02 13:45 - 00000000 ____D () C:\Users\Frank\Documents\Outlook-Dateien
2014-11-18 15:39 - 2013-03-06 14:45 - 00016500 ____H () C:\Users\Frank\Desktop\~WRL0290.tmp
2014-11-18 15:39 - 2013-01-06 14:12 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-18 15:39 - 2013-01-06 14:12 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-18 15:26 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-08 15:49

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-12-2014
Ran by Frank at 2014-12-14 14:53:38
Running from F:\
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG Internet Security 2013 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
FW: AVG Internet Security 2013 (Enabled) {36AFA1E1-4CDC-7EF8-11EE-C77C3581ABA2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Photoshop CS (HKLM-x32\...\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}) (Version: CS - Adobe Systems, Inc.)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{914F7627-B645-9895-F723-BAEAAC865E75}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArrayCalc (HKLM-x32\...\{12A03609-5AED-42F5-853C-79A5309E80D6}) (Version: 6.7.15 - d&b audiotechnik GmbH)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
AuviTran AVS-Monitor (HKLM-x32\...\AuviTran AVS-Monitor) (Version:  - )
Auvitran Firmware Updater (HKLM-x32\...\Auvitran Firmware Updater) (Version:  - )
AVG 2013 (HKLM\...\AVG) (Version: 2013.0.3495 - AVG Technologies)
AVG 2013 (Version: 13.0.3495 - AVG Technologies) Hidden
AVG 2013 (Version: 13.0.4235 - AVG Technologies) Hidden
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v8.00.12(T) - TOSHIBA CORPORATION)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother P-touch Editor 4.2 (HKLM-x32\...\InstallShield_{003447F5-0058-4B77-9C1E-50488F77C4A7}) (Version: 4.2 - Brother Industries, Ltd.)
Brother P-touch Editor 4.2 (x32 Version: 4.2 - Brother Industries, Ltd.) Hidden
Brother P-touch Editor 5.0 (HKLM-x32\...\{DF9A6075-9308-4572-8932-A4316243C4D9}) (Version: 5.0.2300 - Brother Industries, Ltd.)
Brother P-touch Update Software (HKLM-x32\...\{A598BEC3-4F02-413E-9649-C5A1879DB558}) (Version: 1.0.0010 - Brother Industries, Ltd.)
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon Kurzwahlprogramm (HKLM-x32\...\Speed Dial Utility) (Version:  - )
Canon MP Navigator EX 3.1 (HKLM-x32\...\MP Navigator EX 3.1) (Version:  - )
Canon MX870 series Benutzerregistrierung (HKLM-x32\...\Canon MX870 series Benutzerregistrierung) (Version:  - )
Canon MX870 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX870_series) (Version:  - )
Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )
Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version:  - )
CAPS (HKLM-x32\...\{7FEA5EEA-91C7-4387-9585-682A98DE5EB3}) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 3.26 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.0.3717 - CDBurnerXP)
CrystalDiskInfo 5.1.0 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 5.1.0 - Crystal Dew World)
Dante Control and Monitoring (HKLM-x32\...\{32B9C78C-6BA0-456F-8053-5BA6305AEA37}) (Version: 1.7.8.2 - Audinate Pty. Ltd.)
Dante Controller (HKLM-x32\...\{de711cd0-3404-49b5-8d8b-251ceaf5ae35}) (Version: 3.5.3.1 - Audinate Pty. Ltd.)
Dante Controller (x32 Version: 3.5.3.1 - Audinate) Hidden
Dante Discovery (HKLM\...\{BB809BBB-7F71-402D-B0C0-603008B0BB59}) (Version: 1.0.5.1 - Audinate Pty. Ltd.)
Dante Firmware Update Manager (HKLM-x32\...\{60b610c7-22c6-4005-b252-181b2126425e}) (Version: 1.4.7.1 - Audinate Pty. Ltd.)
Dante Firmware Update Manager Core (x32 Version: 1.4.7.1 - Audinate Pty. Ltd.) Hidden
dsdminst (x32 Version: 1.01.0002 - Brother Industries, Ltd.) Hidden
EASE Focus 2 (HKLM-x32\...\InstallShield_{C5A2F0B5-6725-49A5-9E8E-A5FD86C07423}) (Version: 2.0.11 - AFMG)
EASE Focus 2 (x32 Version: 2.0.11 - AFMG) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
EtherSound Runtime x64 v3.12 d (HKLM\...\{0751579A-00BC-425C-A9D9-E6C81A2C54CC}) (Version: 3.12.3 - EtherSound)
FirSoft build 908 - Firnet Controller Software (HKLM-x32\...\{D7820CF7-5420-42AA-B006-768911C8E001}_is1) (Version:  - HKaudio)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
iTunes (HKLM\...\{77DE5105-D05E-448C-96CB-7FA381903753}) (Version: 11.3.1.2 - Apple Inc.)
LG-FCB ControlCenter 1.1 (HKLM-x32\...\LG-FCB ControlCenter) (Version: 1.1 - GORDIUS)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
O2Micro Flash Memory Card Reader Driver (HKLM\...\{729F014A-9E91-49A6-B5F2-E8AA941452AE}) (Version: 3.31.03.A - O2Micro)
Paragon Festplatten Manager™ 12 Professional (HKLM-x32\...\{1E104AF0-EA49-11DE-AC07-005056C00008}) (Version: 90.00.0003 - Paragon Software)
PDF24 Creator 5.2.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PodWare (HKLM-x32\...\{2D9894BE-4FDD-4F2C-9A41-3B683CB90736}) (Version: 5.46.0 - Linea Research)
P-touch Editor 3.2 (HKLM-x32\...\P-touch Editor ver 3.2) (Version:  - )
QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
Soundcraft Virtual Vi 4.7.0 (HKLM-x32\...\SoundcraftVirtualVi) (Version: 4.7.0 - Soundcraft)
Tweaking.com - Windows Repair (All in One) (HKLM-x32\...\Tweaking.com - Windows Repair (All in One)) (Version: 2.10.2 - Tweaking.com)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN)
VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wise Registry Cleaner 7.61 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version:  - WiseCleaner.com, Inc.)
Yamaha Steinberg USB Driver (HKLM-x32\...\InstallShield_{E976141F-5B03-429D-84C2-392E6BB1A45A}) (Version: 1.7.3 - Yamaha Corporation)
Yamaha Steinberg USB Driver (Version: 1.7.3 - Yamaha Corporation) Hidden
YAMAHA THR Editor (HKLM-x32\...\{5115B75F-32BF-42CB-A8BC-2F0A71C4DF93}) (Version: 1.0.0 - Yamaha Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

12-12-2014 16:37:25 Windows Update
12-12-2014 19:12:43 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2014-12-14 13:16 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1CA4762D-C498-470B-B41F-A6ED504F4C91} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-06] (Google Inc.)
Task: {41F32A97-0CC6-4647-A133-A35662D4A7B0} - System32\Tasks\Wise Registry Cleaner Schedule Task => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe [2012-12-25] (WiseCleaner.com)
Task: {76701015-8E62-4CD8-A2D9-6D3484490910} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-06] (Google Inc.)
Task: {B1C44252-1BD1-4366-85BF-EF82418846E0} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {C1E86DA9-8445-4C1F-BF86-7CFD03D79E02} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {E10BF578-A8DE-46D8-8BA2-C3849292AA99} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS\AutoKMS.exe
Task: {E391B2C1-86FD-4E6A-AAD9-EE90B988B698} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-12-19] (Piriform Ltd)
Task: {F1152E3B-7622-4801-81CF-6160718DE352} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-12] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Wise Registry Cleaner Schedule Task.job => C:\Program Files (x86)\Wise\Wise Registry Cleaner\WiseRegCleaner.exe

==================== Loaded Modules (whitelisted) =============

2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-3697939779-1139795273-3143350014-500 - Administrator - Enabled)
Frank (S-1-5-21-3697939779-1139795273-3143350014-1000 - Administrator - Enabled) => C:\Users\TEMP.FRANK-LAPTOP
Gast (S-1-5-21-3697939779-1139795273-3143350014-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3697939779-1139795273-3143350014-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/14/2014 02:33:25 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/14/2014 01:34:22 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/14/2014 01:34:22 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/14/2014 01:34:17 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/14/2014 00:48:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/14/2014 00:47:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (12/14/2014 00:47:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (12/14/2014 00:47:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (12/14/2014 00:47:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Das Profil konnte nicht erfolgreich geladen werden, aber Sie wurden mit dem standardmäßigen Profil für das System angemeldet. 

 Details - Zugriff verweigert

Error: (12/14/2014 00:47:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   20 46.178.168.192.in-addr.arpa. PTR Frank-Laptop.local.


System errors:
=============
Error: (12/14/2014 01:13:07 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description: 

Error: (12/14/2014 00:47:23 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0

Error: (12/14/2014 00:43:27 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Dante Control and Monitoring" wurde mit folgendem Fehler beendet: 
%%12

Error: (12/14/2014 00:43:19 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (12/14/2014 00:30:39 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/14/2014 00:30:39 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/14/2014 00:30:39 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/14/2014 00:30:29 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/14/2014 00:30:29 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (12/14/2014 00:30:29 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068


Microsoft Office Sessions:
=========================
Error: (12/14/2014 02:33:25 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (12/14/2014 01:34:22 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestF:\esetsmartinstaller_deu.exe

Error: (12/14/2014 01:34:22 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestF:\esetsmartinstaller_deu.exe

Error: (12/14/2014 01:34:17 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestF:\esetsmartinstaller_deu.exe

Error: (12/14/2014 00:48:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/14/2014 00:47:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Zugriff verweigert

Error: (12/14/2014 00:47:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Zugriff verweigert

Error: (12/14/2014 00:47:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Zugriff verweigert

Error: (12/14/2014 00:47:07 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1505) (User: FRANK-LAPTOP)
Description: Zugriff verweigert

Error: (12/14/2014 00:47:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: mDNSCoreReceiveResponse: Unexpected conflict discarding   20 46.178.168.192.in-addr.arpa. PTR Frank-Laptop.local.


CodeIntegrity Errors:
===================================
  Date: 2014-12-11 18:02:51.025
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-12-11 18:02:50.931
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Duo CPU T8100 @ 2.10GHz
Percentage of memory in use: 43%
Total physical RAM: 4094.43 MB
Available physical RAM: 2320.82 MB
Total Pagefile: 8187.04 MB
Available Pagefile: 6255.88 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (F1 - SSD Win7) (Fixed) (Total:111.79 GB) (Free:4.49 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (F2 - Hitachi) (Fixed) (Total:232.89 GB) (Free:176.03 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: () (Removable) (Total:1.86 GB) (Free:1.82 GB) FAT
Drive h: () (Removable) (Total:1.85 GB) (Free:1.79 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 2D5D03CE)
Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 111.8 GB) (Disk ID: B2FC597E)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 1.9 GB) (Disk ID: E03BEF58)
Partition 1: (Not Active) - (Size=1.9 GB) - (Type=06)

========================================================
Disk: 3 (Size: 1.9 GB) (Disk ID: 59D5CCB3)
Partition 1: (Not Active) - (Size=1.9 GB) - (Type=06)

==================== End Of Log ============================

Hallo Schrauber,

Hab jetzt das System neu gestartet. Sieht erst mal ok aus. Desktop Hintergrund hat es behalten und meine Icons sind auch noch an der vorherigen Stelle.

Wollte dann noch mal nen Download versuchen. Bis zum Fenster "öffnen/speichern/abbrechen" geht's wunderbar, aber wenn ich auf öffnen oder speichern klicke, tut sich gar nix mehr. mit dem anderen Rechner hats aber funktioniert.

Hast Du in den Logfiles noch etwas finden können?

LG Frank

Hallo nochmal,

hab jetzt nochmal neu gestartet und alles ist wieder durcheinander, der DT-Hintergrund ist schwarz statt der letzten Einstellung und das Fenster mit dem Hinweis auf die Anmeldung als "Standard-Benutzer" geht wieder auf....

Was ist da bloß los ????? Bin der Verzweiflung nahe....

Abgesehen davon nochmal ein gaaaaaanz fettes "DANKE!!!" für Deine Mühe !!!

LG Frank

schrauber · 14.12.2014, 20:52

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3697939779-1139795273-3143350014-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

In welchem Browser geht das laden und speichern nicht? Lege bitte einen neuen Benutzer an mit Adminrechten, boote in diesen. Mehrfach. Dort auch so Probleme?

fracar · 15.12.2014, 10:35

OK Hier nun das aktuelle FRST Logfile.

Ich versuche jetzt mal nen neuen Benutzer anzulegen und mehrmals zu booten. melde mich wieder...

DANKE !!!!!!

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-12-2014
Ran by Frank at 2014-12-15 10:10:18 Run:2
Running from C:\Windows\System32\config\systemprofile\Desktop\Trojaner etc
Loaded Profile: Frank (Available profiles: Frank)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3697939779-1139795273-3143350014-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
Emptytemp:
*****************

"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-3697939779-1139795273-3143350014-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
EmptyTemp: => Removed 761 KB temporary data.


The system needed a reboot. 

==== End of Fixlog ====

Hallo Schrauber,

als ich heute den Laptop zum ersten mal hochgefahren habe, war alles noch wie gestern vor dem Runterfahren. Nach dem letzten Fix und erneutem Hochfahren hab ich wieder nen schwarzen Desktop mit der Meldung des "Benuterprofildienstes" und der Aussage, daß ich mit Standardprofil angemeldet bin. Auch nach mehreren Versuchen passiert nix anderes und ich komme nicht mehr auf meinen Anfangs-Desktop.

Sieht für mich als Laie so aus, als würde das System beim Hochfahren irgendwelche Benutzerprofile durcheinanderbringen, aber ich hab natürlich keine Ahnung, was ich da machen kann und freue mich auf weitere Unterstützung.

DANKE !!!

LG Frank

Durch die Internetsicherheitseinstellungen wurde verhindert, dass eine oder mehrere Dateien geöffnet wurden".

Plagegeister aller Art und deren Bekämpfung: Durch die Internetsicherheitseinstellungen wurde verhindert, dass eine oder mehrere Dateien geöffnet wurden".